CVE-2017-3191

CRITICAL

D-Link DIR-130 and DIR-330 Firmware - Unauthenticated Authentication Bypass via Login Page POST Request

Title source: llm

Description

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in such a manner as to access some administrator-only pages such as tools_admin.asp without credentials.

References (4)

Core 4

Core References

VDB Entry x_refsource_misc

https://exchange.xforce.ibmcloud.com/vulnerabilities/123293

Issue Tracking, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn

https://www.kb.cert.org/vuls/id/553503

Issue Tracking, Third Party Advisory x_refsource_misc

https://www.wilderssecurity.com/threads/d-link-dir-130-and-dir-330-are-vulnerable-to-authentication-bypass-and-do-not-protect-credentials.392703/

Press/Media Coverage x_refsource_misc

https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553/

Scores

CVSS v3 9.8

EPSS 0.6253

EPSS Percentile 99.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20 CWE-294

Status published

Products (4)

D-Link/DIR-130 1.23

d-link/dir-130_firmware 1.23

D-Link/DIR-330 1.12

d-link/dir-330_firmware 1.12

Published Dec 16, 2017

Tracked Since Feb 18, 2026