8.8

CVE-2022-43621

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from an incorrectly implemented comparison. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-16152.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dlink ≫ Dir-1935 Firmware Version <= 1.02
   Dlink ≫ Dir-1935 Version -
Dlink ≫ Dir-1935 Firmware Version 1.03 Update b1
   Dlink ≫ Dir-1935 Version -
Dlink ≫ Dir-1935 Firmware Version 1.03 Update b2
   Dlink ≫ Dir-1935 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.17% 0.799
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trend Micro 8.8 2.8 5.9
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-697 Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect.

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
Patch
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1503/
Third Party Advisory
VDB Entry