CVE-2014-7860: Infoleak
The web/webfile/fbpublish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target albumid and accesstoken.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7860?
CVE-2014-7860 has a medium severity rating due to its potential to allow unauthorized access to published photos.
How do I fix CVE-2014-7860?
To fix CVE-2014-7860, update the firmware of D-Link DNS-320L to version 1.04b12 or newer and DNS-327L to version 1.03b04 Build0119 or newer.
What devices are affected by CVE-2014-7860?
CVE-2014-7860 affects D-Link DNS-320L versions prior to 1.04b12 and DNS-327L versions prior to 1.03b04 Build0119.
What type of vulnerability is CVE-2014-7860?
CVE-2014-7860 is an authentication bypass vulnerability that allows attackers to publish photos without proper authentication.
Can I be attacked if I am using an updated version of the affected devices for CVE-2014-7860?
If you are using an updated version of the affected devices, you are protected from the vulnerability associated with CVE-2014-7860.