full-disclosure - [FD] CVE-2018-5708

Open Source and information security mailing list archives

Message-ID: <CAM-upGr6wP8Hn33Mgyf0i3=UczZixxfnfamUPQ_Ph0PGoYqJ_w@mail.gmail.com>
Date: Wed, 28 Mar 2018 14:13:52 -0400
From: Kevin R <krandall2013@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] CVE-2018-5708

Hello Seclists:

Attached is my writeup for the following CVE: CVE-2018-5708
> An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on
> the same local network as, but being unauthenticated to, the
> administrator's panel, a user can obtain the admin username and
> cleartext password in the response (specifically, the configuration
> file restore_default), which is displayed in XML.
>
> ------------------------------------------
>
> [Additional Information]
> I have been in contact with William Brown CISO of D-Link. Him and his
> team have confirmed the vulnerability and are working on a patch to
> address the issue. Proof of concept exists along with the email
> communication with William Brown if necessary. William Brown has
> confirmed this is a new vulnerability/finding as well.
>
> ------------------------------------------
>
> [VulnerabilityType Other]
> Unauthenticated Admin username and password in cleartext response via XML
>
> ------------------------------------------
>
> [Vendor of Product]
> D-Link
>
> ------------------------------------------
>
> [Affected Product Code Base]
> D-Link DIR-601 - 2.02NA Hardware Version B1
>
> ------------------------------------------
>
> [Affected Component]
> The affected component is the configuration file restore_default which
> leaks the admin username, password along with other device information
> configuration information.
>
> ------------------------------------------
>
> [Attack Type]
> Local
>
> ------------------------------------------
>
> [Impact Information Disclosure]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> To exploit the vulnerability, a user must be on the local network but
> unauthenticated to the admin page.
>
> ------------------------------------------
>
> [Reference]
> https://www.dlink.com
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
>
> ------------------------------------------
>
> [Discoverer]
> Kevin Randal

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives