On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change.
References
Link | Resource |
---|---|
https://xz.aliyun.com/t/2834#toc-5 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
26 Apr 2023, 18:55
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:h:dlink:dir-823g:-:*:*:*:*:*:*:* |
Information
Published : 2018-10-03 20:29
Updated : 2024-02-04 20:03
NVD link : CVE-2018-17881
Mitre link : CVE-2018-17881
CVE.ORG link : CVE-2018-17881
JSON object : View
Products Affected
dlink
- dir-823g
d-link
- dir-823g_firmware
CWE
CWE-640
Weak Password Recovery Mechanism for Forgotten Password