CVE-2017-9542

D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the password field. Successful exploitation of this issue allows an attacker to take control of the affected device.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/98992	Third Party Advisory VDB Entry
https://twitter.com/tiger_tigerboy/status/873458088321220609	Third Party Advisory
https://www.facebook.com/tigerBOY777/videos/1368513696568992/	Permissions Required
http://www.securityfocus.com/bid/98992	Third Party Advisory VDB Entry
https://twitter.com/tiger_tigerboy/status/873458088321220609	Third Party Advisory
https://www.facebook.com/tigerBOY777/videos/1368513696568992/	Permissions Required

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:d-link:dir-615_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-615:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:36

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/98992 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/98992 - Third Party Advisory, VDB Entry
References	~~() https://twitter.com/tiger_tigerboy/status/873458088321220609 - Third Party Advisory~~	() https://twitter.com/tiger_tigerboy/status/873458088321220609 - Third Party Advisory
References	~~() https://www.facebook.com/tigerBOY777/videos/1368513696568992/ - Permissions Required~~	() https://www.facebook.com/tigerBOY777/videos/1368513696568992/ - Permissions Required

Information

Published : 2017-06-11 23:29

Updated : 2024-11-21 03:36

NVD link : CVE-2017-9542

Mitre link : CVE-2017-9542

CVE.ORG link : CVE-2017-9542

JSON object : View

Products Affected

dlink

dir-615

d-link

dir-615_firmware

CWE

CWE-287

Improper Authentication

{"id": "CVE-2017-9542", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-06-11T23:29:00.167", "references": [{"url": "http://www.securityfocus.com/bid/98992", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://twitter.com/tiger_tigerboy/status/873458088321220609", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.facebook.com/tigerBOY777/videos/1368513696568992/", "tags": ["Permissions Required"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/98992", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://twitter.com/tiger_tigerboy/status/873458088321220609", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.facebook.com/tigerBOY777/videos/1368513696568992/", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the password field. Successful exploitation of this issue allows an attacker to take control of the affected device."}, {"lang": "es", "value": "El Enrutador DIR-615 Wireless N 300 de D-Link, permite la omisi\u00f3n de autenticaci\u00f3n por medio de una petici\u00f3n POST modificada para el archivo login.cgi. Este problema ocurre porque no puede comprobar el campo password. La explotaci\u00f3n con \u00e9xito de este problema le permite a un atacante tomar el control del dispositivo afectado."}], "lastModified": "2024-11-21T03:36:21.823", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:d-link:dir-615_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F284D818-EE79-40AF-80B5-77EBE67B4DD7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-615:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2E92E959-C211-4979-A233-163BEFCF6F0D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}