nvd-json-data-feeds/CVE-2019/CVE-2019-186xx/CVE-2019-18666.json

{
  "id": "CVE-2019-18666",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2020-05-15T18:15:13.010",
  "lastModified": "2021-07-21T11:39:23.747",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested. Versions through 6.12b01 have weak root credentials, allowing an attacker to gain remote root access. After 6.12b01, the root credentials were changed but the telnet service can still be started without authorization."
    },
    {
      "lang": "es",
      "value": "Se ha detectado un problema en los dispositivos D-Link DAP-1360 revision F. Los atacantes remotos pueden iniciar un servicio telnet sin autorizaci\u00f3n por medio de una petici\u00f3n HTTP no documentada. Aunque \u00e9sta es la principal vulnerabilidad, el impacto depende de la versi\u00f3n del firmware. Las versiones 609EU a 613EUbeta fueron probadas. Las versiones hasta la 6.12b01 contienen credenciales root d\u00e9biles, permitiendo a un atacante conseguir acceso root remoto. Despu\u00e9s de la versi\u00f3n 6.12b01, las credenciales root fueron cambiadas pero el servicio telnet todav\u00eda puede ser iniciado sin autorizaci\u00f3n."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:d-link:dap-1360_revision_f_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "6.12b01",
              "matchCriteriaId": "5CBA2AE2-552F-4720-A308-8AF58312301D"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:d-link:dap-1360_revision_f:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1A19ECF-475C-4143-8717-5C4C1F78FB86"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://c1a.eu/dlink-dap-1360.html",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://daschloer.github.io/sec/dlink-dap-1360.html",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10171",
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}