Lucene search

ZdiCVE-2023-32145

HistoryMay 03, 2024 - 2:15 a.m.

CVE-2023-32145

2024-05-0302:15:18

CWE-259

zdi

web.nvd.nist.gov

cve-2023-32145

d-link dap-1360

authentication bypass

network-adjacent attack

hardcoded credentials

web-based interface

default credentials

zdi-can-18455

nvd

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of login requests to the web-based user interface. The firmware contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-18455.

Affected configurations

Vulners

Vulnrichment

Node

d-linkdap_2253Range≤6.14

VendorProductVersionCPE
d-linkdap_2253*cpe:2.3:h:d-link:dap_2253:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
d-link	dap_2253	*	cpe:2.3:h:d-link:dap_2253::::::::

CNA Affected

[
  {
    "vendor": "D-Link",
    "product": "DAP-1360",
    "versions": [
      {
        "version": "6.14B01 EU HOTFIX",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324

www.zerodayinitiative.com/advisories/ZDI-23-537/

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

Related for CVE-2023-32145