CVE-2019-7388: dlink dir-823g_firmware

Vulnerability summary

CVE-2019-7388 is a high (CVSS 7.5) vulnerability in dlink dir-823g_firmware. EPSS estimates a 2.83% chance of exploitation in the next 30 days, higher than 86.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-02-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get sensitive information (such as MAC address) about all clients in the WLAN via the GetClientInfo HNAP API. Consequently, an attacker can achieve information disclosure without authentication.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.