VulnerabilityModified
CVE-2019-7390
There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API.
HIGH 8.6EPSS 1.96%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API.
- CVSS 3.0
- 8.6 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- EPSS
- 1.96% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- dlink/dir-823g firmware
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/106855Third Party Advisory
- https://github.com/leonW7/D-Link/blob/master/Vul_5.mdExploit, Third Party Advisory
- http://www.securityfocus.com/bid/106855Third Party Advisory
- https://github.com/leonW7/D-Link/blob/master/Vul_5.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.