CVE-2018-17881 Auth bypass in n/a

Critical 9.8 Published 3 Oct 2018 Updated 5 Aug 2024

Unauthenticated attackers can change the admin password on D-Link DIR-823G routers via the HNAP1 interface, leading to full device compromise.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-17881?

CVE-2018-17881 is a critical authentication bypass vulnerability in n/a, published on 3 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change.

Weakness: CWE-640

Which versions are affected by CVE-2018-17881?

It affects 1 product.

Products include D-Link Dir-823g Firmware.

How do I fix CVE-2018-17881?

No fix has been published for CVE-2018-17881 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-17881 being exploited?

There is no known exploitation of CVE-2018-17881 in the wild and no public exploit code.

Sources

Also known as GHSA-jpmw-83xj-phgp.