D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-816 (B1-2.06?), DIR-850L (A1-1.09), and DIR-868L (A1-1.10).
References
Link | Resource |
---|---|
https://github.com/xw77cve/CVE-2019-7642/blob/master/README.md | Exploit Third Party Advisory |
https://github.com/xw77cve/CVE-2019-7642/blob/master/README.md | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
AND |
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
History
21 Nov 2024, 04:48
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/xw77cve/CVE-2019-7642/blob/master/README.md - Exploit, Third Party Advisory |
Information
Published : 2019-03-25 22:29
Updated : 2024-11-21 04:48
NVD link : CVE-2019-7642
Mitre link : CVE-2019-7642
CVE.ORG link : CVE-2019-7642
JSON object : View
Products Affected
dlink
- dir-850l_firmware
- dir-868l
- dir-817lw_firmware
- dir-816l
- dir-850l
- dir-816
- dir-817lw
- dir-816l_firmware
- dir-816_firmware
- dir-868l_firmware
CWE
CWE-306
Missing Authentication for Critical Function