8.8

CVE-2022-43620

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-16142.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dlink ≫ Dir-1935 Firmware Version <= 1.02
   Dlink ≫ Dir-1935 Version -
Dlink ≫ Dir-1935 Firmware Version 1.03 Update b1
   Dlink ≫ Dir-1935 Version -
Dlink ≫ Dir-1935 Firmware Version 1.03 Update b2
   Dlink ≫ Dir-1935 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.05% 0.599
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trend Micro 8.8 2.8 5.9
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
Patch
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1494/
Third Party Advisory
VDB Entry