CVE-2018-10618
published 2018-08-01CVE-2018-10618: Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain…
PriorityP270critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
10.12%
95.1th percentile
Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| davolink | dvw-3200n | — | — |
| davolink | dvw-3200n_firmware | < 1.00.06 | 1.00.06 |
Detection & IOCsextracted from sources · hover to see the quote
- →Hunt for ZoomEye-indexed Davolink devices by searching for the string 'var user_passwd' combined with the app banner 'DAVOLINK GAPD-7000 WAP httpd' — these are exposed and exploitable targets. ↗
- →Flag any HTTP response on port 88 from a Davolink device that contains the literal string 'var user_passwd=' as this indicates unauthenticated credential disclosure. ↗
- →CVSSv3 score of 9.8 (AV:N/AC:L/PR:N/UI:N) — no authentication, no user interaction required; any inbound connection attempt to port 88 on these devices should be treated as high-risk. ↗
- ·Vulnerability affects all DVW-3200N firmware versions prior to 1.00.06; devices running 1.00.06 or later are patched. ↗
- ·The password is stored/transmitted as a base64-encoded hash (not a strong cryptographic hash), making it trivially reversible — not just crackable. ↗
- ·Exploit was tested on Python 2.7 / Windows 10; the technique is simple enough to be replicated with any HTTP client capable of fetching port 88 and parsing the response body. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f6xc-rcx3-3c9h: Davolink DVW-3200N all version prior to Version 1
ghsa_unreviewed·2022-05-13
CVE-2018-10618 [CRITICAL] CWE-916 GHSA-f6xc-rcx3-3c9h: Davolink DVW-3200N all version prior to Version 1
Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device.
CISA ICS
Davolink DVW-3200N
cisa_ics·2018-07-31·CVSS 9.8
[CRITICAL] Davolink DVW-3200N
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Davolink DVW-3200N
Last RevisedJuly 31, 2018
Alert CodeICSA-18-212-01
## 1. EXECUTIVE SUMMARY
-
CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: Davolink
- Equipment: DVW-3200N
- Vulnerability: Use of Password Hash With Insufficient Computational Effort
## 2. RISK EVALUATION
Successful exploitation of this vulnerability may result in a remote attacker obtaining the password to the device.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of DVW-3200N, a networking switch, are affected:
- DVW-3200N all version prio
No detection rules found.
No writeups or analysis indexed.
2018-08-01
Published