Authentication flaw

2021-10-3119:15:00

PRIOn knowledge base

www.prio-n.com

5.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.3%

JSON

Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users’ DNS query history.

CPENameOperatorVersion
dir-868lw_firmwareeq1.12.98

CPE	Name	Operator	Version
	dir-868lw_firmware	eq	1.12.98

References

d-link.com

dir-868lw.com

github.com/jayus0821/uai-poc/blob/main/D-Link/DIR-868L/webaccess_UAI.md

www.dlink.com/en/security-bulletin/