Details of VAR-201806-1492

ID

VAR-201806-1492

CVE

CVE-2018-6212

TITLE

D-Link DIR-620 Cross-site scripting vulnerability in device firmware

Trust: 0.8

sources: JVNDB: JVNDB-2018-006569

DESCRIPTION

On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, a reflected Cross-Site Scripting (XSS) attack is possible as a result of missed filtration for special characters in the "Search" field and incorrect processing of the XMLHttpRequest object. D-Link DIR-620 The device firmware contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. D-linkDIR-620 is a wireless router product of D-Link. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML. There is a cross-site scripting vulnerability in D-Link DIR-620. Products using the following firmware versions are affected: firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, 2.0.22

Trust: 2.25

sources: NVD: CVE-2018-6212 // JVNDB: JVNDB-2018-006569 // CNVD: CNVD-2018-12849 // VULHUB: VHN-136244

IOT TAXONOMY

category:

['ICS', 'Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-12849

AFFECTED PRODUCTS

vendor:	d link	model:	dir-620	scope:	eq	version:	1.0.3	Trust: 3.0
vendor:	d link	model:	dir-620	scope:	eq	version:	1.0.37	Trust: 3.0
vendor:	d link	model:	dir-620	scope:	eq	version:	1.3.1	Trust: 3.0
vendor:	d link	model:	dir-620	scope:	eq	version:	1.3.3	Trust: 3.0
vendor:	d link	model:	dir-620	scope:	eq	version:	1.3.7	Trust: 3.0
vendor:	d link	model:	dir-620	scope:	eq	version:	1.4.0	Trust: 3.0
vendor:	d link	model:	dir-620	scope:	eq	version:	2.0.22	Trust: 3.0

sources: CNVD: CNVD-2018-12849 // JVNDB: JVNDB-2018-006569 // CNNVD: CNNVD-201806-1064 // NVD: CVE-2018-6212

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-6212
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-6212
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2018-12849
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201806-1064
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-136244
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-6212
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-12849
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-136244
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-6212
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2018-12849 // VULHUB: VHN-136244 // JVNDB: JVNDB-2018-006569 // CNNVD: CNNVD-201806-1064 // NVD: CVE-2018-6212

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-136244 // JVNDB: JVNDB-2018-006569 // NVD: CVE-2018-6212

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201806-1064

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201806-1064

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-006569

PATCH

title:

D-Link DIR-620

url:

http://www.dlink.ru/mn/products/5/1357.html

Trust: 0.8

sources: JVNDB: JVNDB-2018-006569

EXTERNAL IDS

db:	NVD	id:	CVE-2018-6212	Trust: 3.1
db:	JVNDB	id:	JVNDB-2018-006569	Trust: 0.8
db:	CNNVD	id:	CNNVD-201806-1064	Trust: 0.7
db:	CNVD	id:	CNVD-2018-12849	Trust: 0.6
db:	VULHUB	id:	VHN-136244	Trust: 0.1

sources: CNVD: CNVD-2018-12849 // VULHUB: VHN-136244 // JVNDB: JVNDB-2018-006569 // CNNVD: CNNVD-201806-1064 // NVD: CVE-2018-6212

REFERENCES

url:	https://securelist.com/backdoors-in-d-links-backyard/85530/	Trust: 2.5
url:	https://securityaffairs.co/wordpress/72839/hacking/d-link-dir-620-flaws.html	Trust: 2.3
url:	http://www.securitynewspaper.com/2018/05/25/d-link-dir-620-routers-critical-vulnerabilities/	Trust: 1.7
url:	https://www.bleepingcomputer.com/news/security/backdoor-account-found-in-d-link-dir-620-routers/	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-6212	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-6212	Trust: 0.8

sources: CNVD: CNVD-2018-12849 // VULHUB: VHN-136244 // JVNDB: JVNDB-2018-006569 // CNNVD: CNNVD-201806-1064 // NVD: CVE-2018-6212

SOURCES

db:	CNVD	id:	CNVD-2018-12849
db:	VULHUB	id:	VHN-136244
db:	JVNDB	id:	JVNDB-2018-006569
db:	CNNVD	id:	CNNVD-201806-1064
db:	NVD	id:	CVE-2018-6212

LAST UPDATE DATE

2024-11-23T22:58:58.074000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-12849	date:	2018-07-11T00:00:00
db:	VULHUB	id:	VHN-136244	date:	2018-08-11T00:00:00
db:	JVNDB	id:	JVNDB-2018-006569	date:	2018-08-24T00:00:00
db:	CNNVD	id:	CNNVD-201806-1064	date:	2023-04-27T00:00:00
db:	NVD	id:	CVE-2018-6212	date:	2024-11-21T04:10:18.703

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-12849	date:	2018-07-11T00:00:00
db:	VULHUB	id:	VHN-136244	date:	2018-06-20T00:00:00
db:	JVNDB	id:	JVNDB-2018-006569	date:	2018-08-24T00:00:00
db:	CNNVD	id:	CNNVD-201806-1064	date:	2018-06-21T00:00:00
db:	NVD	id:	CVE-2018-6212	date:	2018-06-20T16:29:00.390