D-Link DIR-615 up to 20.12 Session improper authentication

Summaryinfo

A vulnerability, which was classified as critical, has been found in D-Link DIR-615 up to 20.12. This issue affects some unknown processing of the component Session Handler. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2017-7405. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in D-Link DIR-615 up to 20.12 (Router Operating System). This issue affects an unknown functionality of the component Session Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP address belonging to the victim's host, an attacker might be able to take over the administrative session without being prompted for authentication credentials. An attacker can get the victim's and router's IP addresses by simply sniffing the network traffic. Moreover, if the victim has web access enabled on his router and is accessing the web interface from a different network that is behind the NAT/Proxy, an attacker can sniff the network traffic to know the public IP address of the victim's router and take over his session as he won't be prompted for credentials.

The bug was discovered 03/12/2017. The weakness was shared 07/07/2017 (Website). The advisory is shared at ftp2.dlink.com. The identification of this vulnerability is CVE-2017-7405 since 04/03/2017. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 117 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 43507 (D-Link Router DIR-615 Multiple Vulnerabilities).

Upgrading to version 20.12PTb04 eliminates this vulnerability.

The entries VDB-103348 and VDB-103350 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-615

Version

• 20.0
• 20.1
• 20.2
• 20.3
• 20.4
• 20.5
• 20.6
• 20.7
• 20.8
• 20.9
• 20.10
• 20.11
• 20.12

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion