CVE-2018-12710

An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can intercept the response from a POST request to obtain "Admin" rights due to the admin password being displayed in XML.

CVSS v3.0

8.0 HIGHCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

2.7 LOWAV:A/AC:L/Au:S/C:P/I:N/A:N

EPSS

76.51% chance of exploitation in the next 30 days, 100th percentile

Published

2018-08-29

Updated

2024-08-05

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/45306

References

• CVE Record
• NVD entry

Related

• CVE-2018-1271
• CVE-2018-12715
• CVE-2018-12706
• CVE-2018-1273
• CVE-2018-12705
• CVE-2018-12739