CVE-2017-3192

CRITICAL

D-Link DIR-130 and DIR-330 Firmware - Insufficiently Protected Credentials via tools_admin.asp

Title source: llm

Description

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device.

References (4)

Core 4

Core References

Issue Tracking, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn

https://www.kb.cert.org/vuls/id/553503

Issue Tracking, Third Party Advisory x_refsource_misc

https://www.wilderssecurity.com/threads/d-link-dir-130-and-dir-330-are-vulnerable-to-authentication-bypass-and-do-not-protect-credentials.392703/

Issue Tracking, Third Party Advisory, VDB Entry x_refsource_misc

https://exchange.xforce.ibmcloud.com/vulnerabilities/123292

Third Party Advisory x_refsource_misc

https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553/

Scores

CVSS v3 9.8

EPSS 0.3948

EPSS Percentile 98.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-522

Status published

Products (4)

D-Link/DIR-130 1.23

d-link/dir-130_firmware 1.23

D-Link/DIR-330 1.12

d-link/dir-330_firmware 1.12

Published Dec 16, 2017

Tracked Since Feb 18, 2026