10

CVE-2019-18852

Exploit

Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 (for DCN), DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842 C1 v3.00.

Data is provided by the National Vulnerability Database (NVD)
Dlink ≫ Dir-600 B1 Firmware Version2.01
   Dlink ≫ Dir-600 B1 Version-
Dlink ≫ Dir-615 J1 Firmware Version100
   Dlink ≫ Dir-615 J1 Version-
Dlink ≫ Dir-645 A1 Firmware Version1.03
   Dlink ≫ Dir-645 A1 Version-
Dlink ≫ Dir-815 A1 Firmware Version1.01
   Dlink ≫ Dir-815 A1 Version-
Dlink ≫ Dir-823 A1 Firmware Version1.01
   Dlink ≫ Dir-823 A1 Version-
Dlink ≫ Dir-842 C1 Firmware Version3.00
   Dlink ≫ Dir-842 C1 Version-
Dlink ≫ Dir-890l A1 Firmware Version1.03
   Dlink ≫ Dir-890l A1 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.82% 0.721
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.