CVE-2019-15655

D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 78%
VendorProductVersion
dlinkdsl-2875al_firmware
𝑥
≤ 1.00.05
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.dlink.com/en/security-bulletin
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26165
https://www.dlink.com/en/security-bulletin
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26165