** UNSUPPORTED WHEN ASSIGNED ** D-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As weak passwords have been used, the plaintext passwords can be recovered from the hash values. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
References
| Link | Resource |
|---|---|
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10237 | Vendor Advisory |
| https://www.dlink.com/en/security-bulletin/ | Vendor Advisory |
| https://www.nussko.com/advisories/advisory-2021-08-01.txt | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
30 Aug 2021, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-798 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 9.8 |
| References | (MISC) https://www.nussko.com/advisories/advisory-2021-08-01.txt - Exploit, Third Party Advisory | |
| References | (MISC) https://www.dlink.com/en/security-bulletin/ - Vendor Advisory | |
| References | (MISC) https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10237 - Vendor Advisory | |
| CPE | cpe:2.3:o:dlink:dvg-3104ms_firmware:1.0.2.0.4e:*:*:*:*:*:*:* cpe:2.3:o:dlink:dvg-3104ms_firmware:1.0.2.0.3:*:*:*:*:*:*:* cpe:2.3:o:dlink:dvg-3104ms_firmware:1.0.2.0.4:*:*:*:*:*:*:* cpe:2.3:h:dlink:dvg-3104ms:-:*:*:*:*:*:*:* |
23 Aug 2021, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-23 22:15
Updated : 2024-08-04 03:15
NVD link : CVE-2021-39613
Mitre link : CVE-2021-39613
CVE.ORG link : CVE-2021-39613
JSON object : View
Products Affected
dlink
- dvg-3104ms
- dvg-3104ms_firmware
CWE
CWE-798
Use of Hard-coded Credentials