CVE-2018-7698

An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera's stream and make changes without the user's knowledge.

CVSS v3 8.1 HIGH
CVSS v2.0 4.3 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/
https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/

Configurations

Configuration 1 (hide)

cpe:2.3:a:d-link:mydlink\+:3.8.5:*:*:*:*:*:*:*

History

21 Nov 2024, 04:12

Type	Values Removed	Values Added
References	~~() https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/ -~~	() https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/ -

Information

Published : 2018-03-05 19:29

Updated : 2024-11-21 04:12

NVD link : CVE-2018-7698

Mitre link : CVE-2018-7698

CVE.ORG link : CVE-2018-7698

JSON object : View

Products Affected

d-link

mydlink\+

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2018-7698", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2018-03-05T19:29:01.050", "references": [{"url": "https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/", "source": "cve@mitre.org"}, {"url": "https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera's stream and make changes without the user's knowledge."}, {"lang": "es", "value": "Se ha descubierto un problema en D-Link mydlink+ 3.8.5 build 259 para dispositivos DCS-933L 1.05.04 y DCS-934L 1.05.04. La aplicaci\u00f3n mydlink+ env\u00eda el nombre de usuario y la contrase\u00f1a para las c\u00e1maras D-Link conectadas (como DCS-933L y DCS-934L) sin cifrar de la aplicaci\u00f3n a la c\u00e1mara. Esto permite que atacantes obtengan estas credenciales y obtengan el control de la c\u00e1mara, incluyendo la capacidad de ver la transmisi\u00f3n de la c\u00e1mara y realizar cambios sin que el usuario lo sepa."}], "lastModified": "2024-11-21T04:12:33.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:d-link:mydlink\\+:3.8.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96486576-2060-4900-B62C-B9E709DBB389"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}