CVE-2019-17506: Critical severity d-link dir-868l b1 firmware vulnerability
There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZEDGROUP=1%0a to getcfg.php. This could be used to control the router remotely.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17506?
CVE-2019-17506 is considered a high severity vulnerability due to the lack of authentication on web interfaces, allowing unauthorized access to sensitive information.
How do I fix CVE-2019-17506?
To fix CVE-2019-17506, update the firmware of your D-Link DIR-868L or DIR-817LW routers to the latest version provided by D-Link.
What devices are affected by CVE-2019-17506?
CVE-2019-17506 affects D-Link DIR-868L B1 routers with firmware version 2.03 and DIR-817LW A1 routers with firmware version 1.04.
Can I exploit CVE-2019-17506 without physical access?
Yes, CVE-2019-17506 can be exploited remotely since it involves web interfaces with insufficient authentication.
What data can be exposed due to CVE-2019-17506?
CVE-2019-17506 can expose sensitive information including the router's username and password, along with other account details.