Vulnerability Details : CVE-2019-19223
Potential exploit
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to reboot the router by submitting a reboot.html GET request without being authenticated on the admin interface.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2019-19223
- cpe:2.3:o:dlink:dsl-2680_firmware:1.03:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-19223
3.17%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 86 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-19223
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2019-19223
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
-
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-19223
-
https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities
GitHub - 0x8b30cc/DSL-2680-Multiple-Vulnerabilities: D-Link DSL-2680 Multiple VulnerabilitiesThird Party Advisory
-
https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19223.md
DSL-2680-Multiple-Vulnerabilities/CVE-2019-19223.md at master · 0x8b30cc/DSL-2680-Multiple-Vulnerabilities · GitHubExploit;Third Party Advisory
-
https://www.dlink.com/en/security-bulletin
Security Bulletin | D-LinkVendor Advisory
-
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
Third Party Advisory;US Government Resource
Jump to