CVE-2018-10824: Path Traversal
An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. The administrative password is stored in plaintext in the /tmp/csman/0 file. An attacker having a directory traversal (or LFI) can easily get full router access.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10824?
CVE-2018-10824 has a medium severity level due to the exposure of administrative passwords.
How do I fix CVE-2018-10824?
To fix CVE-2018-10824, it is recommended to update the affected D-Link device firmware to the latest version.
Which D-Link devices are affected by CVE-2018-10824?
CVE-2018-10824 affects various D-Link devices including DWR-116, DIR-140L, DIR-640L, DWR-512, DWR-712, DWR-912, DWR-921, and DWR-111.
What kind of data is compromised in CVE-2018-10824?
CVE-2018-10824 compromises administrative passwords that are stored in plaintext.
What should I do if I am using an affected D-Link device and cannot update?
If you are unable to update your affected D-Link device, it is critical to change the default administrative password and limit device exposure to the internet.