CVEvulnerability

CVE-2019-17506

9.8 CRITICAL Published 2019-10-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-10-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-306

Description

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely.

Affected configurations

• dlink dir-868l b1 firmware 2.03 • dlink dir-817lw a1 firmware 1.04

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References