CVE-2018-15516

MEDIUM

D-Link Central WiFiManager CWM-100 1.03 r0098 - Server-Side Request Forgery via FTP PORT Command

Title source: llm
STIX 2.1

Description

The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in SSRF.

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://vimeo.com/299797225
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2018/Nov/27

Scores

CVSS v3 5.8
EPSS 0.0228
EPSS Percentile 84.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Details

CWE
CWE-918
Status published
Products (1)
dlink/central_wifimanager 1.03 r0098
Published Jan 31, 2019
Tracked Since Feb 18, 2026