cbcvebase.
CVE-2013-7055
published 2020-02-04

CVE-2013-7055: D-Link DIR-100 4.03B07 has PPTP and poe information disclosure

PriorityP259critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
6.98%
93.4th percentile
D-Link DIR-100 4.03B07 has PPTP and poe information disclosure

Affected

1 ranges
VendorProductVersion rangeFixed in
dlinkdir-100_firmware——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://192.168.0.1/cliget.cgi?cmd=$poe_user↗
urlhttp://192.168.0.1/cliget.cgi?cmd=$poe_pass↗
urlhttp://192.168.0.1/cliget.cgi?cmd=$pptp_user↗
urlhttp://192.168.0.1/cliget.cgi?cmd=$pptp_pass↗
urlhttp://192.168.0.1/cliget.cgi?cmd=$ddns1↗
urlhttp://192.168.0.1/cliget.cgi?cmd=$log_mail_user↗
urlhttp://192.168.0.1/cliget.cgi?cmd=$log_mail_pwd↗
path/cliget.cgi↗
path/cli.cgi↗
  • →Detect unauthenticated GET requests to /cliget.cgi with cmd parameters referencing sensitive variables ($poe_user, $poe_pass, $pptp_user, $pptp_pass, $ddns1, $log_mail_user, $log_mail_pwd, $sys_user1) — these require no authentication and disclose credentials. ↗
  • →Alert on HTTP GET requests to /cliget.cgi?cmd= from external/untrusted source IPs, as this endpoint is explicitly designed for unauthenticated access and exposes sensitive configuration parameters. ↗
  • →Detect access to /cli.cgi from IP addresses that have no active authenticated session — the device only checks source IP, not cookies or HTTP auth parameters, enabling IP-spoofing or race-condition abuse. ↗
  • →Monitor for POST requests to /login.htm followed immediately by GET requests to /cli.cgi from a different session/tool, indicative of the weak authentication race condition exploit pattern. ↗
  • ·The information disclosure (CVE-2013-7055) specifically covers PPTP and PPPoE credentials, but the same unauthenticated /cliget.cgi endpoint also exposes DynDNS and mail log credentials if those features are configured on the device. ↗
  • ·The vulnerability is significantly more critical when remote administration is enabled, as it exposes the device to exploitation from the internet rather than only the local network. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.