Critical severity · published Nov 11, 2019
CVE-2019-18852
Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 (for DCN), DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842 C1 v3.00.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DB
Dir-600 B1 Firmware · Dlink
2.01 · source: NVD
DJ
Dir-615 J1 Firmware · Dlink
100 · source: NVD
DA
Dir-645 A1 Firmware · Dlink
1.03 · source: NVD
DA
Dir-815 A1 Firmware · Dlink
1.01 · source: NVD
DA
Dir-823 A1 Firmware · Dlink
1.01 · source: NVD
DC
Dir-842 C1 Firmware · Dlink
3.00 · source: NVD
DA
Dir-890l A1 Firmware · Dlink
1.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18852
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18852
Exploit
https://github.com/ChandlerChin/Dlink_vuls/blob/master/A%20hard%20coded%20telnet%20user%20was%20discovered%20in%20multiple%20Dlink%20routers.pdf
More from Dir-600 B1 Firmware
9.8
CVE-2017-12943
D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal attack, as demonstrated…