CVE-2018-20432

D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use hardcoded credentials for telnet connection, which allows unauthenticated attackers to gain privileged access to the router, and to extract sensitive data or modify the configuration.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

3.93% chance of exploitation in the next 30 days, 90th percentile

Published

2020-09-14

Updated

2024-08-05

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/159058/COVR-3902-1.01B0-Hardcoded-Credentials.html

Security advisories

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10109
• https://cybersecurityworks.com/zerodays/cve-2018-20432-dlink.html

References

• CVE Record
• NVD entry