CVE-2020-9376

HIGHNuclei

D-Link DIR-610 Devices - Information Disclosure

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-9376 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Repository PoCs

GitHubrenatoalencar/dlink-dir610-exploitsRepository PoCby renatoalencar4Not analyzed3 files

1.2 KiB · linked to 2 vulnerabilities

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHD-Link DIR-610 Devices - Information DisclosureCVSS 7.5

D-Link DIR-610 devices allow information disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Impact

An attacker can gain sensitive information from the device, leading to potential unauthorized access or further attacks.

Remediation

Apply the latest firmware update provided by D-Link to fix the vulnerability.

WeaknessesCWE-74
Authorswhynotke
Template tagscvecve2020dlinkdisclosureroutervuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:o:dlink:dir-610_firmware:-:*:*:*:*:*:*:*
https://gist.github.com/GouveaHeitor/dcbb67b301cc45adc00f8a6a2a0a590f https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182 https://www.dlink.com.br/produto/dir-610/ https://nvd.nist.gov/vuln/detail/CVE-2020-9376 https://github.com/Z0fhack/Goby_POC

Source: ProjectDiscovery

References

4