CVE-2018-18008 Hardcoded credentials in n/a

Critical 9.8 Published 21 Dec 2018 Updated 5 Aug 2024

Remote attackers can access admin credentials via spaces.htm on D-Link devices, leading to full device compromise.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-18008?

CVE-2018-18008 is a critical vulnerability in n/a, published on 21 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials.

Weakness: CWE-798

Which versions are affected by CVE-2018-18008?

It affects 7 products.

Products include Dlink Dir-140l Firmware, Dlink Dir-640l Firmware, Dlink Dsl-2770l Firmware, Dlink Dwr-116 Firmware, Dlink Dwr-512 Firmware, Dlink Dwr-555 Firmware and 1 more.

How do I fix CVE-2018-18008?

No fix has been published for CVE-2018-18008 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-18008 being exploited?

There is no known exploitation of CVE-2018-18008 in the wild and no public exploit code.

Sources

Also known as GHSA-8fvj-x967-vc6v.