Lucene search

MitreCVE-2018-6213

HistoryJun 20, 2018 - 4:29 p.m.

CVE-2018-6213

2018-06-2016:29:00

CWE-798

mitre

web.nvd.nist.gov

cve-2018-6213

d-link

dir-620

web server

firmware

hardcoded password

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.005

Percentile

76.9%

JSON

In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there is a hardcoded password of anonymous for the admin account.

Affected configurations

Nvd

Node

d-linkdir-620_firmwareMatch1.0.3

d-linkdir-620_firmwareMatch1.0.37

d-linkdir-620_firmwareMatch1.3.1

d-linkdir-620_firmwareMatch1.3.3

d-linkdir-620_firmwareMatch1.3.7

d-linkdir-620_firmwareMatch1.4.0

d-linkdir-620_firmwareMatch2.0.22

AND

dlinkdir-620Match-

VendorProductVersionCPE
d-linkdir-620_firmware1.0.3cpe:2.3:o:d-link:dir-620_firmware:1.0.3:*:*:*:*:*:*:*
d-linkdir-620_firmware1.0.37cpe:2.3:o:d-link:dir-620_firmware:1.0.37:*:*:*:*:*:*:*
d-linkdir-620_firmware1.3.1cpe:2.3:o:d-link:dir-620_firmware:1.3.1:*:*:*:*:*:*:*
d-linkdir-620_firmware1.3.3cpe:2.3:o:d-link:dir-620_firmware:1.3.3:*:*:*:*:*:*:*
d-linkdir-620_firmware1.3.7cpe:2.3:o:d-link:dir-620_firmware:1.3.7:*:*:*:*:*:*:*
d-linkdir-620_firmware1.4.0cpe:2.3:o:d-link:dir-620_firmware:1.4.0:*:*:*:*:*:*:*
d-linkdir-620_firmware2.0.22cpe:2.3:o:d-link:dir-620_firmware:2.0.22:*:*:*:*:*:*:*
dlinkdir-620-cpe:2.3:h:dlink:dir-620:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
d-link	dir-620_firmware	1.0.3	cpe:2.3:o:d-link:dir-620_firmware:1.0.3:::::::*
d-link	dir-620_firmware	1.0.37	cpe:2.3:o:d-link:dir-620_firmware:1.0.37:::::::*
d-link	dir-620_firmware	1.3.1	cpe:2.3:o:d-link:dir-620_firmware:1.3.1:::::::*
d-link	dir-620_firmware	1.3.3	cpe:2.3:o:d-link:dir-620_firmware:1.3.3:::::::*
d-link	dir-620_firmware	1.3.7	cpe:2.3:o:d-link:dir-620_firmware:1.3.7:::::::*
d-link	dir-620_firmware	1.4.0	cpe:2.3:o:d-link:dir-620_firmware:1.4.0:::::::*
d-link	dir-620_firmware	2.0.22	cpe:2.3:o:d-link:dir-620_firmware:2.0.22:::::::*
dlink	dir-620	-	cpe:2.3:h:dlink:dir-620:-:::::::*

References

www.securitynewspaper.com/2018/05/25/d-link-dir-620-routers-critical-vulnerabilities/

securelist.com/backdoors-in-d-links-backyard/85530/

securityaffairs.co/wordpress/72839/hacking/d-link-dir-620-flaws.html

www.bleepingcomputer.com/news/security/backdoor-account-found-in-d-link-dir-620-routers/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.005

Percentile

76.9%

JSON

Related for CVE-2018-6213