XSS vulnerability in htdocs/webinc/js/adv_parent_ctrl_map.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted deviceid parameter to soap.cgi.
References
| Link | Resource |
|---|---|
| ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-860L/REVA/DIR-860L_REVA_FIRMWARE_PATCH_NOTES_1.11B01_EN_WW.pdf | Release Notes Vendor Advisory |
| ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-868L/REVA/DIR-868L_REVA_FIRMWARE_PATCH_NOTES_1.20B01_EN_WW.pdf | Release Notes Vendor Advisory |
| ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-865L/REVA/DIR-865L_REVA_FIRMWARE_PATCH_NOTES_1.10B01_EN_WW.pdf | Release Notes Vendor Advisory |
| https://github.com/TheBeeMan/Pwning-multiple-dlink-router-via-SOAP-proto | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
26 Apr 2023, 19:27
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:d-link:dir-865l_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:d-link:dir-860l:-:*:*:*:*:*:*:* cpe:2.3:o:d-link:dir-868l_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:d-link:dir-865l:-:*:*:*:*:*:*:* |
cpe:2.3:h:dlink:dir-860l:-:*:*:*:*:*:*:* cpe:2.3:o:dlink:dir-865l_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:* cpe:2.3:h:dlink:dir-865l:-:*:*:*:*:*:*:* |
Information
Published : 2018-03-06 20:29
Updated : 2024-02-04 19:46
NVD link : CVE-2018-6527
Mitre link : CVE-2018-6527
CVE.ORG link : CVE-2018-6527
JSON object : View
Products Affected
dlink
- dir-868l_firmware
- dir-868l
- dir-865l_firmware
- dir-860l
- dir-865l
- dir-860l_firmware
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')