Sign-up

ID

VAR-201212-0024


CVE

CVE-2012-4046


TITLE

D-Link DCS-932L Information Disclosure Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2012-7615 // CNNVD: CNNVD-201212-301

DESCRIPTION

The D-Link DCS-932L camera with firmware 1.02 allows remote attackers to discover the password via a UDP broadcast packet, as demonstrated by running the D-Link Setup Wizard and reading the _paramR["P"] value. D-Link DCS-932L Cloud Camera is a home infrared wireless network camera cloud camera. D-Link DCS-932L Cloud Camera has an error when processing UDP requests for device passwords. D-Link DCS-932L is prone to an information-disclosure vulnerability. D-Link DCS-932L 1.02 is vulnerable; other versions may also be affected. CVE-2012-4046 Details: http://www.fishnetsecurity.com/6labs/blog/password-disclosure-d-link-surveillance-cameras-cve-2012-4046 . ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: D-Link DCS-932L Password Request Handling Security Issue SECUNIA ADVISORY ID: SA51610 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/51610/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=51610 RELEASE DATE: 2012-12-20 DISCUSS ADVISORY: http://secunia.com/advisories/51610/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/51610/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=51610 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Jason Doyle has reported a security issue in D-Link DCS-932L, which can be exploited by malicious people to gain knowledge of sensitive information. The vulnerability is reported in firmware version 1.02. SOLUTION: No official solution is currently available. PROVIDED AND/OR DISCOVERED BY: Jason Doyle ORIGINAL ADVISORY: http://www.fishnetsecurity.com/6labs/blog/password-disclosure-d-link-surveillance-cameras-cve-2012-4046 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.7

sources: NVD: CVE-2012-4046 // JVNDB: JVNDB-2012-005793 // CNVD: CNVD-2012-7615 // BID: 57011 // VULHUB: VHN-57327 // PACKETSTORM: 118850 // PACKETSTORM: 118979

IOT TAXONOMY

category:['IoT', 'Network device']sub_category: -

Trust: 0.6

category:['camera device']sub_category:IP camera

Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2012-7615

AFFECTED PRODUCTS

vendor:d linkmodel:dcs-932lscope:eqversion:1.02

Trust: 1.4

vendor:dlinkmodel:dcs-932lscope:eqversion: -

Trust: 1.0

vendor:dlinkmodel:dcs-932lscope:eqversion:1.02

Trust: 1.0

vendor:d linkmodel:dcs-932lscope: - version: -

Trust: 0.8

vendor:d linkmodel:dcs-932l cloud camerascope:eqversion:1100

Trust: 0.6

sources: CNVD: CNVD-2012-7615 // JVNDB: JVNDB-2012-005793 // CNNVD: CNNVD-201212-301 // NVD: CVE-2012-4046

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-4046
value: LOW

Trust: 1.0

NVD: CVE-2012-4046
value: LOW

Trust: 0.8

CNNVD: CNNVD-201212-301
value: LOW

Trust: 0.6

VULHUB: VHN-57327
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2012-4046
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-57327
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-57327 // JVNDB: JVNDB-2012-005793 // CNNVD: CNNVD-201212-301 // NVD: CVE-2012-4046

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-57327 // JVNDB: JVNDB-2012-005793 // NVD: CVE-2012-4046

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201212-301

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201212-301

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-005793

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-57327

PATCH
title:DCS-932Lurl:http://mydlink.dlink.com/products/DCS-932L
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2012-005793

EXTERNAL IDS
db:NVDid:CVE-2012-4046
Trust: 3.7
db:SECUNIAid:51610
Trust: 0.8
db:JVNDBid:JVNDB-2012-005793
Trust: 0.8
db:CNNVDid:CNNVD-201212-301
Trust: 0.7
db:CNVDid:CNVD-2012-7615
Trust: 0.6
db:BIDid:57011
Trust: 0.4
db:PACKETSTORMid:118850
Trust: 0.2
db:OTHERid:NONE
Trust: 0.1
db:SEEBUGid:SSVID-60527
Trust: 0.1
db:VULHUBid:VHN-57327
Trust: 0.1
db:PACKETSTORMid:118979
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CNVD: CNVD-2012-7615 // 
            
            
            
            VULHUB: VHN-57327 // 
            
            
            
            BID: 57011 // 
            
            
            
            JVNDB: JVNDB-2012-005793 // 
            
            
            
            PACKETSTORM: 118850 // 
            
            
            
            PACKETSTORM: 118979 // 
            
            
            
            CNNVD: CNNVD-201212-301 // 
            
            
            
            NVD: CVE-2012-4046

REFERENCES
url:http://www.fishnetsecurity.com/6labs/blog/password-disclosure-d-link-surveillance-cameras-cve-2012-4046
Trust: 1.9
url:http://seclists.org/bugtraq/2012/dec/98
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4046
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4046
Trust: 0.8
url:http://secunia.com/advisories/51610/http
Trust: 0.6
url:http://www.dlink.com/
Trust: 0.3
url:https://ieeexplore.ieee.org/abstract/document/10769424
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2012-4046
Trust: 0.1
url:http://secunia.com/advisories/51610/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=51610
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/blog/325/
Trust: 0.1
url:http://secunia.com/advisories/51610/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CNVD: CNVD-2012-7615 // 
            
            
            
            VULHUB: VHN-57327 // 
            
            
            
            BID: 57011 // 
            
            
            
            JVNDB: JVNDB-2012-005793 // 
            
            
            
            PACKETSTORM: 118850 // 
            
            
            
            PACKETSTORM: 118979 // 
            
            
            
            CNNVD: CNNVD-201212-301 // 
            
            
            
            NVD: CVE-2012-4046

CREDITS
Jason Doyle
Trust: 1.0
sources:
            
            
            BID: 57011 // 
            
            
            
            PACKETSTORM: 118850 // 
            
            
            
            CNNVD: CNNVD-201212-301

SOURCES
db:OTHERid: - 
db:CNVDid:CNVD-2012-7615
db:VULHUBid:VHN-57327
db:BIDid:57011
db:JVNDBid:JVNDB-2012-005793
db:PACKETSTORMid:118850
db:PACKETSTORMid:118979
db:CNNVDid:CNNVD-201212-301
db:NVDid:CVE-2012-4046

LAST UPDATE DATE
2025-01-30T21:55:14.983000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-7615date:2012-12-24T00:00:00
db:VULHUBid:VHN-57327date:2015-03-18T00:00:00
db:BIDid:57011date:2012-12-20T00:00:00
db:JVNDBid:JVNDB-2012-005793date:2012-12-27T00:00:00
db:CNNVDid:CNNVD-201212-301date:2023-04-27T00:00:00
db:NVDid:CVE-2012-4046date:2024-11-21T01:42:06.563

SOURCES RELEASE DATE
db:CNVDid:CNVD-2012-7615date:2012-12-24T00:00:00
db:VULHUBid:VHN-57327date:2012-12-24T00:00:00
db:BIDid:57011date:2012-12-20T00:00:00
db:JVNDBid:JVNDB-2012-005793date:2012-12-27T00:00:00
db:PACKETSTORMid:118850date:2012-12-14T17:22:22
db:PACKETSTORMid:118979date:2012-12-21T08:02:15
db:CNNVDid:CNNVD-201212-301date:2012-12-24T00:00:00
db:NVDid:CVE-2012-4046date:2012-12-24T18:55:02.040