CVE-2017-12943: D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal…

PriorityP273critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

39.22%

98.4th percentile

D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal attack, as demonstrated by discovering the admin password.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-600_b1_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlmodel/__show_info.php?REQUIRE_FILE=%2Fvar%2Fetc%2Fhttpasswd↗

path/var/etc/httpasswd↗

pathmodel/__show_info.php↗

port8080↗

→Detect HTTP requests targeting the vulnerable endpoint with a REQUIRE_FILE parameter containing an absolute path (path traversal). Monitor for GET requests to `model/__show_info.php` with `REQUIRE_FILE=` containing URL-encoded or literal `/` characters pointing to sensitive files such as `/var/etc/httpasswd`. ↗
→Flag unauthenticated HTTP requests to `model/__show_info.php?REQUIRE_FILE=` — no session or authentication cookie is required to exploit this vulnerability, making any such request from an external/WAN source highly suspicious. ↗
→Pay special attention to exploitation attempts over non-standard ports (e.g., 8080) which may indicate remote management is enabled and the device is directly internet-exposed. ↗

·Vulnerability is specific to D-Link DIR-600 Rev Bx hardware with v2.x firmware (confirmed on firmware version 2.01, hardware B1). Other hardware revisions or firmware versions are not confirmed affected. ↗
·Risk is significantly elevated when the device has a public/routable IP address and remote management is enabled, as exploitation requires no authentication. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.