VulnerabilityModified
CVE-2017-9542
D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi.
CRITICAL 9.8EPSS 5.07%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.07%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the password field. Successful exploitation of this issue allows an attacker to take control of the affected device.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 5.07% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- d-link/dir-615 firmware
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/98992Third Party Advisory, VDB Entry
- https://twitter.com/tiger_tigerboy/status/873458088321220609Third Party Advisory
- https://www.facebook.com/tigerBOY777/videos/1368513696568992/Permissions Required
- http://www.securityfocus.com/bid/98992Third Party Advisory, VDB Entry
- https://twitter.com/tiger_tigerboy/status/873458088321220609Third Party Advisory
- https://www.facebook.com/tigerBOY777/videos/1368513696568992/Permissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.