CVE-2019-7642

published 2019-03-25

CVE-2019-7642: D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and…

Priority P3 43 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-816 (B1-2.06?), DIR-850L (A1-1.09), and DIR-868L (A1-1.10).

Affected

5 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-816_firmware	—	—
dlink	dir-816l_firmware	—	—
dlink	dir-817lw_firmware	—	—
dlink	dir-850l_firmware	—	—
dlink	dir-868l_firmware	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306