CVE-2016-1559: Infoleak

Published Apr 21, 2017

Updated

D-Link DAP-1353 H/W vers. B1 3.15 and earlier, D-Link DAP-2553 H/W ver. A1 1.31 and earlier, and D-Link DAP-3520 H/W ver. A1 1.16 and earlier reveal wireless passwords and administrative usernames and passwords over SNMP.

Affected Software

6 affected components

D-Link Dap-1353 H\/w B1 Firmware=3.15

Dlink Dap-1353 H\/w B1

D-Link Dap-2553 H\/w A1 Firmware=1.31

Dlink Dap-2553 H\/w A1

D-Link Dap-3520 H\/w A1 Firmware=1.16

Dlink Dap-3520 H\/w A1

Remediation

Patch Available

http://www.dlink.com/mk/mk/support/support-news/2016/march/16/firmadyne-cve_2016_1558-cve_2016_1559

Event History

Apr 21, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-1559?

CVE-2016-1559 is categorized as a high-severity vulnerability due to the exposure of sensitive information such as wireless passwords and administrative credentials.

How do I fix CVE-2016-1559?

To fix CVE-2016-1559, upgrade the affected D-Link devices to the latest firmware versions that have addressed this vulnerability.

Which D-Link devices are affected by CVE-2016-1559?

CVE-2016-1559 affects D-Link DAP-1353 (H/W ver. B1 3.15 and earlier), DAP-2553 (H/W ver. A1 1.31 and earlier), and DAP-3520 (H/W ver. A1 1.16 and earlier).

What information is exposed in CVE-2016-1559?

CVE-2016-1559 exposes wireless passwords along with administrative usernames and passwords via SNMP.

Is there a workaround for CVE-2016-1559?

While upgrading firmware is the primary solution, disabling SNMP on the affected devices can serve as a temporary workaround for CVE-2016-1559.