D-Link DCS-1100/DCS-1130 Base64 Encoding UDP Packet credentials management

Summaryinfo

A vulnerability classified as critical has been found in D-Link DCS-1100 and DCS-1130. This issue affects some unknown processing of the component Base64 Encoding. This manipulation as part of UDP Packet causes credentials management. This vulnerability is registered as CVE-2017-8417. The attack requires access to the local network. No exploit is available. It is advisable to implement restrictive firewalling.

Detailsinfo

A vulnerability was found in D-Link DCS-1100 and DCS-1130 (version now known). It has been declared as critical. Affected by this vulnerability is some unknown processing of the component Base64 Encoding. The manipulation as part of a UDP Packet leads to a credentials management vulnerability. The CWE definition for the vulnerability is CWE-255. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device's password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.

The weakness was published 07/02/2019 as not defined mailinglist post (Bugtraq). The advisory is shared at seclists.org. This vulnerability is known as CVE-2017-8417 since 05/02/2017. Access to the local network is required for this attack to succeed. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/15/2023). MITRE ATT&CK project uses the attack technique T1552 for this issue.

Proper firewalling of is able to address this issue.

Similar entries are available at VDB-136204, VDB-136205, VDB-136206 and VDB-136207. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• D-Link

Name

• DCS-1100
• DCS-1130

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion