CVE-2019-17525

published 2020-04-21

CVE-2019-17525: The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.

Priority P2 61 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	subversion	>= 0 < 1.9.7-4ubuntu1.1	1.9.7-4ubuntu1.1
apache	subversion	>= 0 < 1.13.0-3ubuntu0.2	1.13.0-3ubuntu0.2
dlink	dir-615_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → The CAPTCHA bypass is achieved by reusing the same CAPTCHA value across repeated login requests without reloading a new one, enabling brute-force of credentials on the D-Link DIR-615 T1 20.10 login page. ↗
• → Alert on HTTP responses containing the strings 'the validatecode is invalid' or 'username or password error, try again' in rapid succession from a single source, as these are the error strings used to identify failed brute-force attempts against this device. ↗

• · The vulnerability is specific to firmware version 20.10 on hardware version T1 of the D-Link DIR-615. Other hardware or firmware versions may not be affected. ↗
• · The CAPTCHA bypass requires the attacker to first solve the CAPTCHA once manually, then replay that same token repeatedly — meaning the attack is not fully automated from scratch but requires an initial valid CAPTCHA solve. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

osv 6.5 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-307