CVE-2019-7389: dlink dir-823g_firmware

Vulnerability summary

CVE-2019-7389 is a high (CVSS 7.8) vulnerability in dlink dir-823g_firmware. EPSS estimates a 2.73% chance of exploitation in the next 30 days, higher than 85.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-02-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to reset the router without authentication via the SetFactoryDefault HNAP API. Consequently, an attacker can achieve a denial-of-service attack without authentication.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.