CVE-2018-8898

published 2018-05-23

CVE-2018-8898: A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24"…

Priority P2 74 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616E6771696F6E67") allows unauthenticated attackers to perform arbitrary modification (read, write) to passwords and configurations meanwhile an administrator is logged into the web panel.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dsl-3782_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://192.168.1.1/romfile.cfg↗

url http://192.168.1.1/cgi-bin/get/New_GUI/Settings_24.asp↗

url http://192.168.1.1/cgi-bin/get/New_GUI/Settings_5.asp↗

url http://192.168.1.1/cgi-bin/New_GUI/GuestZone.asp↗

url http://192.168.1.1/cgi-bin/get/New_GUI/get_sessionKey.asp↗

url http://192.168.1.1/cgi-bin/New_GUI/Set/Admin.asp↗

url http://192.168.1.1/cgi-bin/New_GUI/WiFi_loding.asp↗

url http://192.168.1.1/cgi-bin/New_GUI/Set/firmware_upgrade.asp↗

url http://192.168.1.1/cgi-bin/New_GUI/Set/reboot_wait.asp↗

url /cgi-bin/New_GUI/Set/config_upgrade.asp↗

path /romfile.cfg↗

command curl --data "Password=[NEW_PASSWORD_SET_BY_THE_ATTACKER]" --data "sessionKey=$(curl -sS http://192.168.1.1/cgi-bin/get/New_GUI/get_sessionKey.asp)" http://192.168.1.1/cgi-bin/New_GUI/Set/Admin.asp↗

filename romfile.cfg↗

• → Alert on unauthenticated POST requests to /cgi-bin/New_GUI/Set/Admin.asp containing a 'Password' and 'sessionKey' parameter — this is the primary exploitation pattern for admin password takeover. ↗
• → Monitor for POST requests to /cgi-bin/New_GUI/Set/firmware_upgrade.asp or /cgi-bin/New_GUI/Set/config_upgrade.asp without a valid authenticated session — these indicate attempted firmware or configuration replacement. ↗

• · Vulnerability is only exploitable while a legitimate administrator is actively logged into the web panel (within the server-side session timeout window of a few minutes). ↗
• · Affected version is specifically A1_WI_20170303 (SWVer=V100R001B012, FWVer=3.10.0.24, FirmVer=TT_77616E6771696F6E67); other firmware forks have not been tested and may or may not be affected. ↗
• · Guest network users are also capable of exploiting this vulnerability due to missing network segmentation on the device. ↗
• · If the router's web panel is exposed to the Internet, the attack surface extends to anonymous remote attackers, not just LAN/Guest users. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287