CVE-2017-3192
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device.
La versión de firmware 1.23 de DIR-130 y la versión de firmware 1.12 de DIR-330 de D-Link no protegen suficientemente las credenciales de administrador. La página tools_admin.asp revela la contraseña del administrador en codificación base64 en la página web de retorno. Un atacante remoto con acceso a esta página (pudiendo ser mediante una omisión de autenticación como CVE-2017-3191) puede obtener credenciales de administrador para el dispositivo.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-12-05 CVE Reserved
- 2017-12-15 CVE Published
- 2023-11-25 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-522: Insufficiently Protected Credentials
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/123292 | Issue Tracking | |
| https://www.kb.cert.org/vuls/id/553503 | Issue Tracking |
|
| https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553 | Third Party Advisory | |
| https://www.wilderssecurity.com/threads/d-link-dir-130-and-dir-330-are-vulnerable-to-authentication-bypass-and-do-not-protect-credentials.392703 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| D-link Search vendor "D-link" | Dir-130 Firmware Search vendor "D-link" for product "Dir-130 Firmware" | 1.23 Search vendor "D-link" for product "Dir-130 Firmware" and version "1.23" | - |
Affected
| in | Dlink Search vendor "Dlink" | Dir-130 Search vendor "Dlink" for product "Dir-130" | - | - |
Safe
|
| D-link Search vendor "D-link" | Dir-330 Firmware Search vendor "D-link" for product "Dir-330 Firmware" | 1.12 Search vendor "D-link" for product "Dir-330 Firmware" and version "1.12" | - |
Affected
| in | Dlink Search vendor "Dlink" | Dir-330 Search vendor "Dlink" for product "Dir-330" | - | - |
Safe
|