CVE-2017-3191
16.12.2017, 02:29
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in such a manner as to access some administrator-only pages such as tools_admin.asp without credentials.Enginsight
| Vendor | Product | Version |
|---|---|---|
| d-link | dir-130_firmware | 1.23 |
| d-link | dir-330_firmware | 1.12 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-294 - Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
References