Summaryinfo

A vulnerability was found in D-Link DSR. It has been classified as critical. The affected element is an unknown function of the component Firmware. The manipulation leads to credentials management. This vulnerability is traded as CVE-2013-7004. Furthermore, there is an exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in D-Link DSR (Router Operating System). This issue affects an unknown code block of the component Firmware. The manipulation with an unknown input leads to a credentials management vulnerability. Using CWE to declare the problem leads to CWE-255. Impacted is confidentiality. The summary by CVE is:

D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 have a hardcoded account of username gkJ9232xXyruTRmY, which makes it easier for remote attackers to obtain access by leveraging knowledge of the username.

The weakness was shared 12/18/2013 (Website). It is possible to read the advisory at exploit-db.com. The identification of this vulnerability is CVE-2013-7004 since 12/07/2013. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.

Upgrading to version 1.06b53 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (30061). The entries VDB-11475 and VDB-65820 are related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DSR

Version

• -
• 1.01b46
• 1.01b50
• 1.01b56
• 1.02b11
• 1.02b25
• 1.03b12
• 1.03b23
• 1.03b27
• 1.03b36
• 1.03b43
• 1.04b58
• 1.05b20
• 1.05b29
• 1.05b35
• 1.05b46
• 1.05b48
• 1.05b50
• 1.05b53
• 1.06b43
• 1.06b53
• 1.08b29
• 1.08b31
• 1.08b39
• 1.08b51

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion