CVE-2018-20675

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow authentication bypass.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101	Vendor Advisory
https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dlink:dir-822_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-822:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:dlink:dir-822-us_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-822-us:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:dlink:dir-850l_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

OR	cpe:2.3:o:dlink:dir-850l_firmware::::::::
	cpe:2.3:o:dlink:dir-850l_firmware:2.22b02:beta::::::

cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

OR	cpe:2.3:o:dlink:dir-880l_firmware::::::::
	cpe:2.3:o:dlink:dir-880l_firmware:1.20b01:beta::::::

cpe:2.3:h:dlink:dir-880l:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:01

Type	Values Removed	Values Added
References	~~() https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101 - Vendor Advisory~~	() https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101 - Vendor Advisory

Information

Published : 2019-01-09 00:29

Updated : 2024-11-21 04:01

NVD link : CVE-2018-20675

Mitre link : CVE-2018-20675

CVE.ORG link : CVE-2018-20675

JSON object : View

Products Affected

dlink

dir-822-us
dir-822_firmware
dir-850l
dir-880l_firmware
dir-822-us_firmware
dir-850l_firmware
dir-822
dir-880l

CWE

CWE-287

Improper Authentication

{"id": "CVE-2018-20675", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-01-09T00:29:00.240", "references": [{"url": "https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow authentication bypass."}, {"lang": "es", "value": "Los dispositivos D-Link que utilizan determinadas versiones (las DIR-822 C1 anteriores a la v3.11B01Beta, las DIR-822-US C1 anteriores a la v3.11B01Beta, las DIR-850L A* anteriores a la v1.21B08Beta, las DIR-850L B* anteriores a la v2.22B03Beta y las DIR-880L A* anteriores a la v1.20B02Beta) permiten la omisi\u00f3n de autenticaci\u00f3n."}], "lastModified": "2024-11-21T04:01:58.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-822_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DCBEAD7-2C7B-43FC-9352-B520F31035EE", "versionEndIncluding": "3.10b06"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-822:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B3894F0E-37F8-4A89-87AC-1DB524D4AE04"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-822-us_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "820E41C7-8D99-4B71-8C6E-9064E5173168", "versionEndIncluding": "3.10b06"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-822-us:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "670ED1ED-F14F-45F6-BE40-F3F1B1ED853F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-850l_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E47C6FC0-783C-4D65-9F26-0E2C2E288936", "versionEndIncluding": "1.21b07"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "607DDB44-0E4E-4606-8909-B624345688D4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-850l_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE9D7484-AB7F-4276-BAEF-C0D6AC698123", "versionEndIncluding": "2.21b01"}, {"criteria": "cpe:2.3:o:dlink:dir-850l_firmware:2.22b02:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92FF706E-89F6-47BA-988D-A78B7AD1FAC0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "607DDB44-0E4E-4606-8909-B624345688D4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-880l_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CF193C4-D65C-4708-83A4-7D1859B1E978", "versionEndIncluding": "1.07.b08"}, {"criteria": "cpe:2.3:o:dlink:dir-880l_firmware:1.20b01:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "678EA257-C88B-4447-A318-C2F799D57A46"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-880l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CC772491-6371-4712-B358-E74D9C5062FD"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}