CVE-2018-6213 Hardcoded credentials in n/a

Critical 9.8 Published 20 Jun 2018 Updated 5 Aug 2024

Attackers can gain administrative access to specific ISP-customized D-Link DIR-620 routers using a hardcoded anonymous password.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-6213?

CVE-2018-6213 is a critical vulnerability in n/a, published on 20 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there is a hardcoded password of anonymous for the admin account.

Weakness: CWE-798

Which versions are affected by CVE-2018-6213?

It affects 1 product.

Products include D-Link Dir-620 Firmware.

How do I fix CVE-2018-6213?

No fix has been published for CVE-2018-6213 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-6213 being exploited?

There is no known exploitation of CVE-2018-6213 in the wild and no public exploit code.

Sources

Also known as GHSA-4xfh-7qvx-mp6f.