CVE-2017-3192 - CVE Vulnerability

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device. (CVSS:0.0) (Last Update:2017-12-15)

Vulnerability Details : D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device. Publish Date : 2017-12-15 Last Update Date : 2017-12-15 - CVSS Scores & Vulnerability Types CVSS Score 0.0 Confidentiality Impact ??? Integrity Impact ??? Availability Impact ??? Access Complexity ??? Authentication ??? Gained Access None Vulnerability Type(s) Bypass a restriction or similar CWE ID CWE id is not defined for this vulnerability - Products Affected By CVE-2017-3192 # Product Type Vendor Product Version Update Edition Language No vulnerable product found. If the vulnerability is created recently it may take a few days to gather vulnerable products list and other information like cvss scores. Please check again in a few days. - References For CVE-2017-3192 https://exchange.xforce.ibmcloud.com/vulnerabilities/123292 https://www.kb.cert.org/vuls/id/553503 CERT-VN VU#553503 https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553/ https://www.wilderssecurity.com/threads/d-link-dir-130-and-dir-330-are-vulnerable-to-authentication-bypass-and-do-not-protect-credentials.392703/

- Metasploit Modules Related To CVE-2017-3192 There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)