CVE-2019-7388: Infoleak
An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get sensitive information (such as MAC address) about all clients in the WLAN via the GetClientInfo HNAP API. Consequently, an attacker can achieve information disclosure without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2019-7388.
What devices are affected by this vulnerability?
This vulnerability affects D-Link DIR-823G devices with firmware 1.02B03.
What is the severity of CVE-2019-7388?
The severity of CVE-2019-7388 is high with a CVSS score of 7.5.
How can attackers exploit this vulnerability?
Attackers can exploit this vulnerability by using the GetClientInfo HNAP API to retrieve sensitive information, such as MAC addresses, about all clients in the WLAN.
Are there any known fixes for this vulnerability?
There is no known fix for this vulnerability at the moment. It is recommended to update the firmware of the affected devices if a patch becomes available.