Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-18666

An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested. Versions through 6.12b01 have weak root credentials, allowing an attacker to gain remote root access. After 6.12b01, the root credentials were changed but the telnet service can still be started without authorization.

Published

2020-05-15T18:15:13.010

Last Modified

2024-11-21T04:33:29.393

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-306

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	dlink	dap-1360_revision_f_firmware	≤ 6.12b01	Yes
Hardware	dlink	dap-1360_revision_f	-	No

References

http://c1a.eu/dlink-dap-1360.html Exploit, Third Party Advisory ([email protected])
https://daschloer.github.io/sec/dlink-dap-1360.html Exploit, Third Party Advisory ([email protected])
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10171 Patch, Vendor Advisory ([email protected])
http://c1a.eu/dlink-dap-1360.html Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://daschloer.github.io/sec/dlink-dap-1360.html Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10171 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)