CVE-2018-5708: dlink dir-601_firmware Insufficiently Protected Credentials

Vulnerability summary

CVE-2018-5708 is a high (CVSS 8.0) Insufficiently Protected Credentials vulnerability in dlink dir-601_firmware. EPSS estimates a 5.99% chance of exploitation in the next 30 days, higher than 93.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-03-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a user can obtain the admin username and cleartext password in the response (specifically, the configuration file restore_default), which is displayed in XML.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.