CRITICAL🇵🇱 Wersja polska

CVE-2019-18852

CVSS 9.8v3.1pub. 2019-11-11upd. 2024-11-21

Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 (for DCN), DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842 C1 v3.00.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dlink Dir 600 B1

    HW
    Dlink
    all versions

  • Dlink Dir 600 B1 Firmware

    OS
    Dlink
    2.01

  • Dlink Dir 615 J1

    HW
    Dlink
    all versions

  • Dlink Dir 615 J1 Firmware

    OS
    Dlink
    100

  • Dlink Dir 645 A1

    HW
    Dlink
    all versions

  • Dlink Dir 645 A1 Firmware

    OS
    Dlink
    1.03

  • Dlink Dir 815 A1

    HW
    Dlink
    all versions

  • Dlink Dir 815 A1 Firmware

    OS
    Dlink
    1.01

  • Dlink Dir 823 A1

    HW
    Dlink
    all versions

  • Dlink Dir 823 A1 Firmware

    OS
    Dlink
    1.01

  • Dlink Dir 842 C1

    HW
    Dlink
    all versions

  • Dlink Dir 842 C1 Firmware

    OS
    Dlink
    3.00

  • Dlink Dir 890l A1

    HW
    Dlink
    all versions

  • Dlink Dir 890l A1 Firmware

    OS
    Dlink
    1.03
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-42627CRITICAL9.8PL ✓same product

D-Link DIR-615: dostęp do strony konfiguracji WAN bez uwierzytelnienia

CVE-2017-12943CRITICAL9.8PL ✓same product

D-Link DIR-600: path traversal umożliwia odczyt haseł bez uwierzytelnienia

CVE-2024-3272CRITICAL9.8⚠ KEVPL ✓same vendor

D-Link DNS-320L/325/327L/340L — zakodowane na stałe poświadczenia (hard-coded credentials)

CVE-2023-25280CRITICAL9.8⚠ KEVPL ✓same vendor

Command Injection w D-Link DIR-820L umożliwiający eskalację uprawnień do root

CVE-2016-20017CRITICAL9.8⚠ KEVPL ✓same vendor

D-Link DSL-2750B — zdalne command injection bez uwierzytelnienia (CLI)