CVE-2019-17506
CRITICAL EXPLOITED NUCLEIDlink Dir-868l B1 Firmware - Missing Authentication
Title source: ruleDescription
There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely.
Nuclei Templates (1)
D-Link DIR-868L/817LW - Information Disclosure
CRITICALby pikpikcu
Scores
CVSS v3
9.8
EPSS
0.9385
EPSS Percentile
99.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2023-11-17
CWE
CWE-306
Status
published
Products (2)
dlink/dir-817lw_a1_firmware
1.04
dlink/dir-868l_b1_firmware
2.03
Published
Oct 11, 2019
Tracked Since
Feb 18, 2026