Details of VAR-201803-2290

ID

VAR-201803-2290

CVE

CVE-2018-7698

TITLE

D-Link mydlink+ Vulnerabilities in certificate and password management

Trust: 0.8

sources: JVNDB: JVNDB-2018-002759

DESCRIPTION

An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera's stream and make changes without the user's knowledge. D-Link mydlink+ Contains a vulnerability related to certificate and password management.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. D-LinkDCS-933L and DCS-934L are D-Link's network camera products. Mydlink+ is an application for remote access to camera devices such as the DCS-933L and DCS-934L. A security vulnerability exists in the D-LinkDCS-933L1.05.04 release and the mydlink+3.8.5build259 release in the DCS-934L1.05.04 release. The vulnerability is caused by the program not encrypting the username and password when they are sent from the application to the camera. An attacker could exploit the vulnerability to obtain credentials and control the camera. Encrypt it

Trust: 2.25

sources: NVD: CVE-2018-7698 // JVNDB: JVNDB-2018-002759 // CNVD: CNVD-2018-05967 // VULHUB: VHN-137730

IOT TAXONOMY

category:

['IoT', 'Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-05967

AFFECTED PRODUCTS

vendor:	d link	model:	mydlink\+	scope:	eq	version:	3.8.5	Trust: 1.6
vendor:	d link	model:	mydlink+	scope:	eq	version:	3.8.5 build 259	Trust: 0.8
vendor:	d link	model:	dcs-933l	scope:	eq	version:	1.05.04	Trust: 0.6
vendor:	d link	model:	dcs-934l	scope:	eq	version:	1.05.04	Trust: 0.6

sources: CNVD: CNVD-2018-05967 // JVNDB: JVNDB-2018-002759 // CNNVD: CNNVD-201803-116 // NVD: CVE-2018-7698

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-7698
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-7698
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2018-05967
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201803-116
value:	HIGH
Trust: 0.6
VULHUB:	VHN-137730
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-7698
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-05967
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-137730
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-7698
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.2
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2018-05967 // VULHUB: VHN-137730 // JVNDB: JVNDB-2018-002759 // CNNVD: CNNVD-201803-116 // NVD: CVE-2018-7698

PROBLEMTYPE DATA

problemtype:	CWE-522	Trust: 1.1
problemtype:	CWE-255	Trust: 0.9

sources: VULHUB: VHN-137730 // JVNDB: JVNDB-2018-002759 // NVD: CVE-2018-7698

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-116

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201803-116

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-002759

PATCH

title:

Mobile Apps /mydlink+

url:

https://www.dlink.com.br/produto/mydlink

Trust: 0.8

sources: JVNDB: JVNDB-2018-002759

EXTERNAL IDS

db:	NVD	id:	CVE-2018-7698	Trust: 3.1
db:	JVNDB	id:	JVNDB-2018-002759	Trust: 0.8
db:	CNVD	id:	CNVD-2018-05967	Trust: 0.6
db:	CNNVD	id:	CNNVD-201803-116	Trust: 0.6
db:	VULHUB	id:	VHN-137730	Trust: 0.1

sources: CNVD: CNVD-2018-05967 // VULHUB: VHN-137730 // JVNDB: JVNDB-2018-002759 // CNNVD: CNNVD-201803-116 // NVD: CVE-2018-7698

REFERENCES

url:	https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/	Trust: 1.7
url:	http://www.nettexsolutions.com/2018/03/04/d-link-security-cameras-using-mydlink-leak-passwords-to-the-internet/	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7698	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7698	Trust: 0.8

sources: CNVD: CNVD-2018-05967 // VULHUB: VHN-137730 // JVNDB: JVNDB-2018-002759 // CNNVD: CNNVD-201803-116 // NVD: CVE-2018-7698

SOURCES

db:	CNVD	id:	CNVD-2018-05967
db:	VULHUB	id:	VHN-137730
db:	JVNDB	id:	JVNDB-2018-002759
db:	CNNVD	id:	CNNVD-201803-116
db:	NVD	id:	CVE-2018-7698

LAST UPDATE DATE

2024-08-14T13:28:45.894000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-05967	date:	2018-03-22T00:00:00
db:	VULHUB	id:	VHN-137730	date:	2019-10-03T00:00:00
db:	JVNDB	id:	JVNDB-2018-002759	date:	2018-04-27T00:00:00
db:	CNNVD	id:	CNNVD-201803-116	date:	2019-10-08T00:00:00
db:	NVD	id:	CVE-2018-7698	date:	2019-10-03T00:03:26.223

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-05967	date:	2018-03-22T00:00:00
db:	VULHUB	id:	VHN-137730	date:	2018-03-05T00:00:00
db:	JVNDB	id:	JVNDB-2018-002759	date:	2018-04-27T00:00:00
db:	CNNVD	id:	CNNVD-201803-116	date:	2018-03-06T00:00:00
db:	NVD	id:	CVE-2018-7698	date:	2018-03-05T19:29:01.050