CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2021-39615

CVSS 9.8v3.1pub. 2021-08-23upd. 2024-11-21

D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the cleartext password of the identified hash value, he will be able to log in via SSH or Telnet and thus gain access to the underlying embedded Linux operating system on the device. Fixed in version 2.12/2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dlink Dsr 500n

    HW
    Dlink
    all versions

  • Dlink Dsr 500n Firmware

    OS
    Dlink
    1.02
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2013-5945CRITICAL9.8PL ✓same product

SQL Injection w D-Link DSR — zdalne wykonanie poleceń SQL bez uwierzytelnienia

CVE-2020-25759HIGH8.8same product

An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router w...

CVE-2020-25757HIGH8.8same product

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary i...

CVE-2020-25758HIGH8.8same product

An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksum...

CVE-2013-5946HIGH10.0same product

The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firm...