D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext.
References
| Link | Resource |
|---|---|
| https://www.dlink.com/en/security-bulletin | Vendor Advisory |
| https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26165 | Exploit Third Party Advisory |
| https://www.dlink.com/en/security-bulletin | Vendor Advisory |
| https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26165 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 04:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.dlink.com/en/security-bulletin - Vendor Advisory | |
| References | () https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26165 - Exploit, Third Party Advisory |
08 Nov 2023, 22:48
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:dlink:dsl-2875al_firmware:*:*:*:*:*:*:*:* | |
| First Time |
Dlink dsl-2875al Firmware
|
26 Apr 2023, 18:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Dlink dsl-2875al
Dlink |
|
| CPE | cpe:2.3:h:dlink:dsl-2875al:-:*:*:*:*:*:*:* |
Information
Published : 2020-03-19 18:15
Updated : 2024-11-21 04:29
NVD link : CVE-2019-15655
Mitre link : CVE-2019-15655
CVE.ORG link : CVE-2019-15655
JSON object : View
Products Affected
dlink
- dsl-2875al
- dsl-2875al_firmware