Vulnerability-Lookup

CNVD-2018-05967

Vulnerability from cnvd - Published: 2018-03-22

Title

D-Link DCS-933L和DCS-934L权限获取漏洞

Description

D-Link DCS-933L和DCS-934L都是友讯（D-Link）公司的网络摄像机产品。mydlink+是一款用于远程访问DCS-933L和DCS-934L等摄像设备的应用程序。 D-Link DCS-933L 1.05.04版本和DCS-934L 1.05.04版本中的mydlink+ 3.8.5 build 259版本存在安全漏洞，该漏洞源于程序在将用户名和密码从应用程序发送到摄像机时，未对其进行加密。攻击者可利用该漏洞获取凭证并控制摄像机。

Severity

高

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： http://www.dlink.com/

Reference

http://www.nettexsolutions.com/2018/03/04/d-link-security-cameras-using-mydlink-leak-passwords-to-the-internet/

Impacted products

Name
['D-Link DCS-933L 1.05.04', 'D-Link DCS-934L 1.05.04']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-7698"
    }
  },
  "description": "D-Link DCS-933L\u548cDCS-934L\u90fd\u662f\u53cb\u8baf\uff08D-Link\uff09\u516c\u53f8\u7684\u7f51\u7edc\u6444\u50cf\u673a\u4ea7\u54c1\u3002mydlink+\u662f\u4e00\u6b3e\u7528\u4e8e\u8fdc\u7a0b\u8bbf\u95eeDCS-933L\u548cDCS-934L\u7b49\u6444\u50cf\u8bbe\u5907\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nD-Link DCS-933L 1.05.04\u7248\u672c\u548cDCS-934L 1.05.04\u7248\u672c\u4e2d\u7684mydlink+ 3.8.5 build 259\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5728\u5c06\u7528\u6237\u540d\u548c\u5bc6\u7801\u4ece\u5e94\u7528\u7a0b\u5e8f\u53d1\u9001\u5230\u6444\u50cf\u673a\u65f6\uff0c\u672a\u5bf9\u5176\u8fdb\u884c\u52a0\u5bc6\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u51ed\u8bc1\u5e76\u63a7\u5236\u6444\u50cf\u673a\u3002",
  "discovererName": "unknow",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttp://www.dlink.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-05967",
  "openTime": "2018-03-22",
  "products": {
    "product": [
      "D-Link DCS-933L 1.05.04",
      "D-Link DCS-934L 1.05.04"
    ]
  },
  "referenceLink": "http://www.nettexsolutions.com/2018/03/04/d-link-security-cameras-using-mydlink-leak-passwords-to-the-internet/",
  "serverity": "\u9ad8",
  "submitTime": "2018-03-07",
  "title": "D-Link DCS-933L\u548cDCS-934L\u6743\u9650\u83b7\u53d6\u6f0f\u6d1e"
}

CVE-2018-7698 (GCVE-0-2018-7698)

Vulnerability from cvelistv5 – Published: 2018-03-05 19:00 – Updated: 2024-08-05 06:31

Summary

An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera's stream and make changes without the user's knowledge.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
https://blog.nickleghorn.com/2019/06/16/d-link-se…	x_refsource_MISC

Date Public

2018-03-05 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:31:05.067Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-03-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera\u0027s stream and make changes without the user\u0027s knowledge."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-03T19:51:11.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-7698",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera\u0027s stream and make changes without the user\u0027s knowledge."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/",
              "refsource": "MISC",
              "url": "https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-7698",
    "datePublished": "2018-03-05T19:00:00.000Z",
    "dateReserved": "2018-03-05T00:00:00.000Z",
    "dateUpdated": "2024-08-05T06:31:05.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-05967

CVE-2018-7698 (GCVE-0-2018-7698)

Tags

Sightings

Nomenclature