CVE Vulnerability

CVE-2021-39615

** UNSUPPORTED WHEN ASSIGNED ** D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the cleartext password of the identified hash value, he will be able to log in via SSH or Telnet and thus gain access to the underlying embedded Linux operating system on the device. Fixed in version 2.12/2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.dlink.com/en/security-bulletin/ Vendor Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10235 Vendor Advisory
https://www.nussko.com/advisories/advisory-2021-08-02.txt Exploit Third Party Advisory
Configurations

Configuration 1
Information

Published : 2021-08-23 10:15

Updated : 2021-08-30 05:38

NVD link : CVE-2021-39615

Mitre link : CVE-2021-39615

Products Affected
No products.
CWE
CWE-798