CVE-2018-17777 - An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices

Back Back to CVE browser

CRITICAL

An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices

Published Dec 18, 2018

9.8

CRITICAL

CVSS 3.1

EPSS 1.87%

Description

An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN (0000), it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have access to the router control panel with administrator privileges.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-9524
Advisory
https://www.gubello.me/blog/router-dlink-dva-5592-authentication-bypass/
x_refsource_MISCMitigationThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-9524		Advisory
https://www.gubello.me/blog/router-dlink-dva-5592-authentication-bypass/		x_refsource_MISCMitigationThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 18, 2018

Updated Aug 5, 2024

Reserved Sep 28, 2018

Link CVE-2018-17777

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-17777

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Dec 18, 2018

Updated Aug 5, 2024

Link EUVD-2018-9524

GitHub

No data