CVE-2013-6026
The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.68%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 7.68% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- dlink/di-524up · dlink/di-604\+ · dlink/di-604s · dlink/di-604up · dlink/di-624s · dlink/dir-100 · dlink/dir-120 · dlink/tm-g5240 · alphanetworks/vdsl asl-55052 · alphanetworks/vdsl asl-56552 · planex/brl-04cw · planex/brl-04r · planex/brl-04ur
- Source
- cret@cert.org
References
- http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/Exploit
- http://www.dlink.com/uk/en/support/security
- http://www.kb.cert.org/vuls/id/248083US Government Resource
- http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/Exploit
- http://www.dlink.com/uk/en/support/security
- http://www.kb.cert.org/vuls/id/248083US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.