CVE-2017-8409: dlink dcs-1130_firmware Improper Authorization
Vulnerability summary
CVE-2017-8409 is a high (CVSS 7.5) Improper Authorization vulnerability in dlink dcs-1130_firmware. EPSS estimates a 2.71% chance of exploitation in the next 30 days, higher than 85.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 02-07-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.71%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.71% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIot Vulnerabilities
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Dlink1 product
1 vendor · 1 product
References
3 links- packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdfX Refsource MISCExploitThird Party Advisory