CVE-2015-7245

published 2017-04-24

CVE-2015-7245: Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive…

Priority P2 65 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
d-link	dvg-n5402sp_firmware	—	—
d-link	dvg-n5402sp_firmware	—	—
d-link	dvg-n5402sp_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /cgibin/webproc↗

path /cgi­bin/webproc↗

command getpage=html%2Findex.html&*errorpage*=../../../../../../../../../../../etc/passwd&var%3Amenu=setup&var%3Apage=connected&var%&objaction=auth&%3Ausername=blah&%3Apassword=blah&%3Aaction=login&%3Asessionid=abcdefgh↗

command getpage=html%2Findex.html&*errorpage*=../../../../../../../../../../../etc/shadow&var%3Amenu=setup&var%3Apage=connected&var% &obj­action=auth&%3Ausername=blah&%3Apassword=blah&%3Aaction=login&%3Asessionid=abcdefgh↗

port 8080↗

• → Exploit requires no authentication; detect unauthenticated POST requests to /cgi-bin/webproc containing directory traversal sequences (../) in the 'errorpage' parameter. ↗
• → Alert on POST body containing the 'errorpage' parameter with path traversal sequences targeting sensitive files such as /etc/passwd or /etc/shadow. ↗
• → Successful exploitation returns /etc/shadow content in the HTTP response body; match on patterns like 'root::' followed by numeric fields in responses from the device. ↗
• → Device management interface is exposed on port 8080; monitor for traversal attempts on this non-standard port targeting /cgi-bin/webproc. ↗
• → Default hardcoded credentials root:root and tw:tw may be used for Telnet access post-exploitation; monitor Telnet login attempts with these credentials. ↗

• · Vulnerability affects only specific firmware versions; detection should be scoped to devices running W1000CN-00, W1000CN-03, or W2000EN-00. ↗
• · The 'tw' login account is not active by default, reducing the Telnet attack surface for that credential, though root:root remains a risk when Telnet is enabled. ↗
• · The restricted 'support' user can also access the configuration backup file, meaning privilege escalation is possible from a low-privilege account without exploiting the path traversal. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22