Search
Find a vulnerability
Search criteria
4 vulnerabilities found for dcs-7517_firmware by dlink
CVE-2025-6932 (GCVE-0-2025-6932)
Vulnerability from nvd – Published: 2025-06-30 23:02 – Updated: 2025-07-01 13:39 Unsupported When Assigned
VLAI
EPSS
VEX
Title
D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password
Summary
A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /bin/httpd of the component Qlync Password Generation Handler. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.314445 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.314445 | signaturepermissions-required |
| https://vuldb.com/?submit.605595 | third-party-advisory |
| http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.0… | exploit |
| https://www.dlink.com/ | product |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6932",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-01T13:39:05.223867Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-01T13:39:11.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Qlync Password Generation Handler"
],
"product": "DCS-7517",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "2.02"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /bin/httpd of the component Qlync Password Generation Handler. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer."
},
{
"lang": "de",
"value": "Es wurde eine problematische Schwachstelle in D-Link DCS-7517 bis 2.02.0 gefunden. Es betrifft die Funktion g_F_n_GenPassForQlync der Datei /bin/httpd der Komponente Qlync Password Generation Handler. Durch Beeinflussen mit unbekannten Daten kann eine use of hard-coded password-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig auszunutzen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-30T23:02:08.045Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-314445 | D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.314445"
},
{
"name": "VDB-314445 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.314445"
},
{
"name": "Submit #605595 | dlink DCS-7517B1 below or equal v2.02.01 hardcode weak password",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.605595"
},
{
"tags": [
"exploit"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.01/report_2.pdf"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2025-06-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-30T18:04:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-6932",
"datePublished": "2025-06-30T23:02:08.045Z",
"dateReserved": "2025-06-30T15:59:46.451Z",
"dateUpdated": "2025-07-01T13:39:11.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6931 (GCVE-0-2025-6931)
Vulnerability from nvd – Published: 2025-06-30 22:32 – Updated: 2025-07-01 13:45 Unsupported When Assigned
VLAI
EPSS
VEX
Title
D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy
Summary
A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_from_mac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.314443 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.314443 | signaturepermissions-required |
| https://vuldb.com/?submit.605592 | third-party-advisory |
| https://vuldb.com/?submit.605593 | third-party-advisory |
| https://vuldb.com/?submit.605596 | third-party-advisory |
| http://cdn2.v50to.cc/dlink/DCS-6517B1_FW_v2.02.01… | related |
| http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.0… | exploit |
| https://www.dlink.com/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6931",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-01T13:45:36.961287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-01T13:45:40.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-6517B1_FW_v2.02.01/report_3.pdf"
},
{
"tags": [
"exploit"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.01/report_1.pdf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Root Password Generation Handler"
],
"product": "DCS-6517",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "2.02"
}
]
},
{
"modules": [
"Root Password Generation Handler"
],
"product": "DCS-7517",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "2.02"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_from_mac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer."
},
{
"lang": "de",
"value": "In D-Link DCS-6517 and DCS-7517 bis 2.02.0 wurde eine problematische Schwachstelle entdeckt. Dabei geht es um die Funktion generate_pass_from_mac der Datei /bin/httpd der Komponente Root Password Generation Handler. Durch Manipulieren mit unbekannten Daten kann eine insufficient entropy-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie gilt als schwierig ausnutzbar. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-331",
"description": "Insufficient Entropy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-30T22:32:09.468Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-314443 | D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.314443"
},
{
"name": "VDB-314443 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.314443"
},
{
"name": "Submit #605592 | dlink DCS-6517B1 below or equal v2.02.01 hardcode weak password",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.605592"
},
{
"name": "Submit #605593 | dlink DCS-7517B1 below or equal v2.02.01 predictable weak password (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.605593"
},
{
"name": "Submit #605596 | dlink DCS-7517B1 below or equal v2.02.01 hardcode weak password (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.605596"
},
{
"tags": [
"related"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-6517B1_FW_v2.02.01/report_3.pdf"
},
{
"tags": [
"exploit"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.01/report_1.pdf"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2025-06-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-30T17:57:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-6931",
"datePublished": "2025-06-30T22:32:09.468Z",
"dateReserved": "2025-06-30T15:52:42.960Z",
"dateUpdated": "2025-07-01T13:45:40.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6932 (GCVE-0-2025-6932)
Vulnerability from cvelistv5 – Published: 2025-06-30 23:02 – Updated: 2025-07-01 13:39 Unsupported When Assigned
VLAI
EPSS
VEX
Title
D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password
Summary
A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /bin/httpd of the component Qlync Password Generation Handler. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.314445 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.314445 | signaturepermissions-required |
| https://vuldb.com/?submit.605595 | third-party-advisory |
| http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.0… | exploit |
| https://www.dlink.com/ | product |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6932",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-01T13:39:05.223867Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-01T13:39:11.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Qlync Password Generation Handler"
],
"product": "DCS-7517",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "2.02"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /bin/httpd of the component Qlync Password Generation Handler. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer."
},
{
"lang": "de",
"value": "Es wurde eine problematische Schwachstelle in D-Link DCS-7517 bis 2.02.0 gefunden. Es betrifft die Funktion g_F_n_GenPassForQlync der Datei /bin/httpd der Komponente Qlync Password Generation Handler. Durch Beeinflussen mit unbekannten Daten kann eine use of hard-coded password-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig auszunutzen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-30T23:02:08.045Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-314445 | D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.314445"
},
{
"name": "VDB-314445 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.314445"
},
{
"name": "Submit #605595 | dlink DCS-7517B1 below or equal v2.02.01 hardcode weak password",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.605595"
},
{
"tags": [
"exploit"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.01/report_2.pdf"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2025-06-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-30T18:04:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-6932",
"datePublished": "2025-06-30T23:02:08.045Z",
"dateReserved": "2025-06-30T15:59:46.451Z",
"dateUpdated": "2025-07-01T13:39:11.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6931 (GCVE-0-2025-6931)
Vulnerability from cvelistv5 – Published: 2025-06-30 22:32 – Updated: 2025-07-01 13:45 Unsupported When Assigned
VLAI
EPSS
VEX
Title
D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy
Summary
A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_from_mac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.314443 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.314443 | signaturepermissions-required |
| https://vuldb.com/?submit.605592 | third-party-advisory |
| https://vuldb.com/?submit.605593 | third-party-advisory |
| https://vuldb.com/?submit.605596 | third-party-advisory |
| http://cdn2.v50to.cc/dlink/DCS-6517B1_FW_v2.02.01… | related |
| http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.0… | exploit |
| https://www.dlink.com/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6931",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-01T13:45:36.961287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-01T13:45:40.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-6517B1_FW_v2.02.01/report_3.pdf"
},
{
"tags": [
"exploit"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.01/report_1.pdf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Root Password Generation Handler"
],
"product": "DCS-6517",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "2.02"
}
]
},
{
"modules": [
"Root Password Generation Handler"
],
"product": "DCS-7517",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "2.02"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CookedMelon (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_from_mac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer."
},
{
"lang": "de",
"value": "In D-Link DCS-6517 and DCS-7517 bis 2.02.0 wurde eine problematische Schwachstelle entdeckt. Dabei geht es um die Funktion generate_pass_from_mac der Datei /bin/httpd der Komponente Root Password Generation Handler. Durch Manipulieren mit unbekannten Daten kann eine insufficient entropy-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie gilt als schwierig ausnutzbar. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-331",
"description": "Insufficient Entropy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-30T22:32:09.468Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-314443 | D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.314443"
},
{
"name": "VDB-314443 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.314443"
},
{
"name": "Submit #605592 | dlink DCS-6517B1 below or equal v2.02.01 hardcode weak password",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.605592"
},
{
"name": "Submit #605593 | dlink DCS-7517B1 below or equal v2.02.01 predictable weak password (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.605593"
},
{
"name": "Submit #605596 | dlink DCS-7517B1 below or equal v2.02.01 hardcode weak password (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.605596"
},
{
"tags": [
"related"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-6517B1_FW_v2.02.01/report_3.pdf"
},
{
"tags": [
"exploit"
],
"url": "http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.01/report_1.pdf"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2025-06-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-30T17:57:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-6931",
"datePublished": "2025-06-30T22:32:09.468Z",
"dateReserved": "2025-06-30T15:52:42.960Z",
"dateUpdated": "2025-07-01T13:45:40.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}