CVE-2019-19598 - D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value

Back Back to CVE browser

HIGH

D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value

Published Dec 5, 2019

8.8

HIGH

CVSS 3.1

EPSS 3.51%

Description

D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value. In HTTP requests, part of the HNAP_AUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to the value stored in the device's /var/hnap/timestamp file, the request will pass the HNAP_AUTH check function.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (3)

https://chung96vn.wordpress.com/2019/11/15/d-link-dap-1860-vulnerabilities/
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9213
Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10135
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://chung96vn.wordpress.com/2019/11/15/d-link-dap-1860-vulnerabilities/		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9213		Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10135		x_refsource_MISCThird Party Advisory