Sign-up

ID

VAR-200505-0119


CVE

CVE-2005-1827


TITLE

D-Link DSL router can bypass access authentication vulnerability

Trust: 0.6

sources: CNVD: CNVD-2005-1916

DESCRIPTION

D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as upgrade firmware, restart the router or restore a saved configuration, via a direct request to firmwarecfg. D-Link DSL routers are commonly used routers in homes and small offices.  D-Link DSL routers have problems with user authentication. Remote attackers could use this vulnerability to gain unauthorized access to devices.  When executing CGI / cgi-bin / firmwarecfg, the script checks if the fw_ip file exists in / var / tmp /. If this file exists, all IP addresses listed therein will be allowed to access the device directly without authentication. If this file does not exist, CGI will create a new file with the requested address written in it.  If the web configuration console can be accessed from the Internet and no one has called CGI before, any user can access the router, download the config.xml file containing the user account and password, and cause access to the private network, modify or change the router's firmware Wait. This issue is due to a failure of the devices to require authentication in certain circumstances. Various D-Link devices with the following firmware revisions are affected by this issue: - V1.00B01T16.EN.20040211 - V1.00B01T16.EU.20040217 - V0.00B01T04.UK.20040220 - V1.00B01T16.EN.20040226 - V1.00B02T02.EU.20040610 - V1.00B02T02.UK.20040618 - V1.00B02T02.EU.20040729 - V1.00B02T02.DE.20040813 - V1.00B02T02.RU.20041014 Due to the common practice of code reuse, other devices are also likely affected by this issue. ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: D-Link DSL Routers "firmwarecfg" Authentication Bypass SECUNIA ADVISORY ID: SA15422 VERIFY ADVISORY: http://secunia.com/advisories/15422/ CRITICAL: Moderately critical IMPACT: Security Bypass, System access WHERE: >From local network OPERATING SYSTEM: D-Link DSL-504T http://secunia.com/product/5128/ D-Link DSL-G604T http://secunia.com/product/5127/ DESCRIPTION: A security issue has been reported in various D-Link DSL routers, which can be exploited by malicious people to gain unauthorised access to a vulnerable device. The problem is caused due to an undocumented feature where the "cgi-bin/firmwarecfg" script grants the first user, who requests the script, access to the router. This can e.g. be exploited to modify the firmware of the router. PROVIDED AND/OR DISCOVERED BY: Independently discovered by: * Francesco Orro * Luis Peralta ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.89

sources: NVD: CVE-2005-1827 // CNVD: CNVD-2005-1916 // BID: 13679 // VULHUB: VHN-13036 // PACKETSTORM: 37683

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2005-1916

AFFECTED PRODUCTS

vendor:dlinkmodel:dsl-504tscope:eqversion:1.00b01t16.eu.20040217

Trust: 1.0

vendor:nonemodel: - scope: - version: -

Trust: 0.6

vendor:d linkmodel:dsl-504tscope:eqversion:v1.00b01t16.eu.2004-02-17

Trust: 0.6

vendor:puntomodel:adsl aethra starbridge e-uscope: - version: -

Trust: 0.3

vendor:ecimodel:telecom b-focus routerscope:eqversion:312+

Trust: 0.3

vendor:ecimodel:telecom b-focus multiportscope:eqversion:342+

Trust: 0.3

vendor:ecimodel:telecom b-focus comboscope:eqversion:322+

Trust: 0.3

vendor:d linkmodel:dsl-g604tscope: - version: -

Trust: 0.3

vendor:d linkmodel:dsl-562tscope: - version: -

Trust: 0.3

vendor:d linkmodel:dsl-504tscope: - version: -

Trust: 0.3

vendor:d linkmodel:dsl-502tscope: - version: -

Trust: 0.3

vendor:d linkmodel:dsl-500t v1.00b02t02.ru.20050scope: - version: -

Trust: 0.3

sources: CNVD: CNVD-2005-1916 // BID: 13679 // CNNVD: CNNVD-200505-1215 // NVD: CVE-2005-1827

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-1827
value: HIGH

Trust: 1.0

CNNVD: CNNVD-200505-1215
value: HIGH

Trust: 0.6

VULHUB: VHN-13036
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2005-1827
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-13036
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-13036 // CNNVD: CNNVD-200505-1215 // NVD: CVE-2005-1827

PROBLEMTYPE DATA

problemtype:CWE-425

Trust: 1.0

sources: NVD: CVE-2005-1827

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200505-1215

TYPE

access verification error

Trust: 0.6

sources: CNNVD: CNNVD-200505-1215

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-13036

EXTERNAL IDS
db:NVDid:CVE-2005-1827
Trust: 2.6
db:BIDid:13679
Trust: 2.0
db:SECUNIAid:15422
Trust: 1.8
db:CNNVDid:CNNVD-200505-1215
Trust: 0.7
db:CNVDid:CNVD-2005-1916
Trust: 0.6
db:BUGTRAQid:20050526 DSL-504T (AND MAYBE MANY OTHER) REMOTE ACCESS WITHOUT PASSWORD BUG
Trust: 0.6
db:SEEBUGid:SSVID-79341
Trust: 0.1
db:EXPLOIT-DBid:25684
Trust: 0.1
db:VULHUBid:VHN-13036
Trust: 0.1
db:PACKETSTORMid:37683
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2005-1916 // 
            
            
            
            VULHUB: VHN-13036 // 
            
            
            
            BID: 13679 // 
            
            
            
            PACKETSTORM: 37683 // 
            
            
            
            CNNVD: CNNVD-200505-1215 // 
            
            
            
            NVD: CVE-2005-1827

REFERENCES
url:http://www.securityfocus.com/bid/13679
Trust: 1.7
url:http://secunia.com/advisories/15422
Trust: 1.7
url:http://marc.info/?l=bugtraq&m=111722515805478&w=2
Trust: 1.0
url:http://marc.theaimsgroup.com/?l=bugtraq&m=111722515805478&w=2
Trust: 0.6
url:http://www.d-link.com/
Trust: 0.3
url:/archive/1/400251
Trust: 0.3
url:http://marc.info/?l=bugtraq&m=111722515805478&w=2
Trust: 0.1
url:http://secunia.com/advisories/15422/
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/5127/
Trust: 0.1
url:http://secunia.com/secunia_vacancies/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/product/5128/
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-13036 // 
            
            
            
            BID: 13679 // 
            
            
            
            PACKETSTORM: 37683 // 
            
            
            
            CNNVD: CNNVD-200505-1215 // 
            
            
            
            NVD: CVE-2005-1827

CREDITS
Francesco Orro※ francesco.orro@akhela.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200505-1215

SOURCES
db:CNVDid:CNVD-2005-1916
db:VULHUBid:VHN-13036
db:BIDid:13679
db:PACKETSTORMid:37683
db:CNNVDid:CNNVD-200505-1215
db:NVDid:CVE-2005-1827

LAST UPDATE DATE
2024-08-14T14:35:49.257000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2005-1916date:2005-05-20T00:00:00
db:VULHUBid:VHN-13036date:2016-10-18T00:00:00
db:BIDid:13679date:2011-12-20T12:19:00
db:CNNVDid:CNNVD-200505-1215date:2005-10-20T00:00:00
db:NVDid:CVE-2005-1827date:2024-01-25T21:08:43.237

SOURCES RELEASE DATE
db:CNVDid:CNVD-2005-1916date:2005-05-20T00:00:00
db:VULHUBid:VHN-13036date:2005-05-26T00:00:00
db:BIDid:13679date:2005-05-19T00:00:00
db:PACKETSTORMid:37683date:2005-05-29T20:22:44
db:CNNVDid:CNNVD-200505-1215date:2005-05-26T00:00:00
db:NVDid:CVE-2005-1827date:2005-05-26T04:00:00