Vulners
Lucene search
D-Link Routers - Plaintext Password Vulnerability
| Reporter | Title | Published | Views | Family All 27 |
|---|---|---|---|---|
 | D-Link Routers - Directory Traversal Vulnerability | 25 Oct 201800:00 | – | zdt |
 | The vulnerability in the web interface of D-Link’s microprogrammed router software allows a hacker to gain access to and read arbitrary files. | 16 Nov 201800:00 | – | bdu_fstec |
| The vulnerability of D-Link router microprogramming software, related to the storage of passwords in an unencrypted form, allows a hacker to gain full control over the device. | 16 Nov 201800:00 | – | bdu_fstec |
 | CVE-2018-10822 | 17 Oct 201815:59 | – | circl |
| CVE-2018-10824 | 17 Oct 201815:59 | – | circl |
 | D-Link Router Password Plaintext Storage Vulnerability | 17 Oct 201800:00 | – | cnvd |
| D-Link router httpd server directory traversal vulnerability | 17 Oct 201800:00 | – | cnvd |
 | CVE-2018-10822 | 17 Oct 201814:00 | – | cve |
| CVE-2018-10824 | 17 Oct 201814:00 | – | cve |
 | CVE-2018-10822 | 17 Oct 201814:00 | – | cvelist |
10
## Password stored in plaintext
CVE: CVE-2018-10824
Description:
An issue was discovered on D-Link routers:
DWR-116 through 1.06,
DIR-140L through 1.02,
DIR-640L through 1.02,
DWR-512 through 2.02,
DWR-712 through 2.02,
DWR-912 through 2.02,
DWR-921 through 2.02,
DWR-111 through 1.01,
and probably others with the same type of firmware.
NOTE: I have changed the filename in description to XXX because the vendor leaves some EOL routers unpatched and the attack is too simple
The administrative password is stored in plaintext in the /tmp/XXX/0 file. An attacker having a directory traversal (or LFI) can easily get full router access.
PoC using the directory traversal vulnerability disclosed above - CVE-2018-10822
`$ curl http://routerip/uir//tmp/XXX/0`
This command returns a binary config file which contains admin username and password as well as many other router configuration settings. By using the directory traversal vulnerability it is possible to read the file without authentication.
# 0day.today [2018-10-25] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Oct 2018 00:00Current
0.2Low risk
Vulners AI Score0.2
EPSS0.85876