Critical severity · published Aug 23, 2021
CVE-2021-39615
D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the cleartext password…
9.8
CVSS
2.2%
EPSS
No
On KEV
Description
D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the cleartext password of the identified hash value, he will be able to log in via SSH or Telnet and thus gain access to the underlying embedded Linux operating system on the device. Fixed in version 2.12/2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dsr-500n Firmware · Dlink
1.02 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-39615
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-39615
Vendor Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10235
Vendor Advisory
https://www.dlink.com/en/security-bulletin/
Exploit
https://www.nussko.com/advisories/advisory-2021-08-02.txt
More from Dsr-500n Firmware
9.8
CVE-2013-5945
Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44;…
8.8
CVE-2020-25759
An issue was discovered on D-Link DSR-250 3.17 devices
8.8
CVE-2020-25758
An issue was discovered on D-Link DSR-250 3.17 devices
8.8
CVE-2020-25757
A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary…
–
CVE-2013-7005
D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and…