CVE Feed

    Dashboard / CVE / CVE-2019-18852

    CVE-2019-18852

    Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 (for DCN), DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842 C1 v3.00.

    Published:Nov 11, 2019
    Last Modified:Nov 21, 2024
    EPS:Nov 11, 2019
    EPSS Score:0.00817
    CVSS Score:9.8

    Affected Products

    Vendor
    Dlink
    Product
    Dir-600 B1
    Vendor
    Dlink
    Product
    Dir-600 B1 Firmware
    Vendor
    Dlink
    Product
    Dir-615 J1
    Vendor
    Dlink
    Product
    Dir-615 J1 Firmware
    Vendor
    Dlink
    Product
    Dir-645 A1
    Vendor
    Dlink
    Product
    Dir-645 A1 Firmware
    Vendor
    Dlink
    Product
    Dir-815 A1
    Vendor
    Dlink
    Product
    Dir-815 A1 Firmware
    Vendor
    Dlink
    Product
    Dir-823 A1
    Vendor
    Dlink
    Product
    Dir-823 A1 Firmware
    Vendor
    Dlink
    Product
    Dir-842 C1
    Vendor
    Dlink
    Product
    Dir-842 C1 Firmware
    Vendor
    Dlink
    Product
    Dir-890l A1
    Vendor
    Dlink
    Product
    Dir-890l A1 Firmware

    Exploits

    https://github.com/ChandlerChin/Dlink_vuls/blob/master/A%20hard%20coded%20telnet%20user%20was%20discovered%20in%20multiple%20Dlink%20routers.pdfhttps://github.com/ChandlerChin/Dlink_vuls/blob/master/A%20hard%20coded%20telnet%20user%20was%20discovered%20in%20multiple%20Dlink%20routers.pdf

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High