Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-8898

CWE-287 — Improper Authentication4 documents4 sources

Severity

9.8CRITICAL

EPSS

14.5%

top 5.54%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Dlink Dsl-3782 Firmware

Timeline

PublishedMay 23

Latest updateMay 14

Description

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616E6771696F6E67") allows unauthenticated attackers to perform arbitrary modification (read, write) to passwords and configurations meanwhile an administrator is logged into the web panel.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDdlink/dsl-3782_firmware3.10.0.24

🔴Vulnerability Details

GHSA

GHSA-cfxc-8f2g-m9vp: A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3↗2022-05-14

▶

CVEList

CVE-2018-8898: A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3↗2018-05-23

▶

💥Exploits & PoCs

Exploit-DB

D-Link DSL-3782 - Authentication Bypass↗2018-05-20

▶