CVE-2015-7246: D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which…

PriorityP274critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

14.30%

96.2th percentile

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which makes it easier for remote attackers to obtain administrative access.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
d-link	dvg-n5402sp_firmware	—	—
d-link	dvg-n5402sp_firmware	—	—
d-link	dvg-n5402sp_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

commandroot:root (default credential)↗

commandtw:tw (default credential)↗

path/cgi-bin/webproc↗

port8080↗

cookiesessionid=abcdefgh; language=en_us; sys_UserName=super↗

→Monitor Telnet service logins using default credentials root:root or tw:tw on D-Link DVG-N5402SP devices; successful Telnet authentication with these credentials indicates exploitation of CVE-2015-7246. ↗
→Alert on HTTP POST requests to /cgi-bin/webproc on port 8080 where the body contains 'errorpage' with traversal sequences ('..'), as no authentication is required to exploit the path traversal (CVE-2015-7245, related attack vector on same device). ↗
→Flag HTTP responses from /cgi-bin/webproc that set a persistent session cookie with expiry 'Fri, 31-Dec-9999 23:59:59 GMT', which is characteristic of this device's authentication flow and may indicate active session establishment during exploitation. ↗

·Affected firmware versions are W1000CN-00, W1000CN-03, and W2000EN-00; detections should be scoped to devices running these specific firmware versions. ↗
·The restricted 'support' user account can also access the configuration backup file, which contains cleartext credentials, enabling privilege escalation without needing default root/tw credentials. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.