CVE-2019-1010155 Auth bypass in DSL-2750U

Critical 9.1 Published 23 Jul 2019 Updated 5 Aug 2024

Unauthenticated access to the login wizard in D-Link DSL-2750U allows potential denial of service and information leakage, though disputed by third parties.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1010155?

CVE-2019-1010155 is a critical authentication bypass vulnerability in D-Link DSL-2750U, published on 23 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third parties dispute this issues as not being a vulnerability because although the wizard is accessible without authentication, it can't actually configure anything. Thus, there is no denial of service or information leakage

Which versions are affected by CVE-2019-1010155?

It affects 1 product.

Products include Dlink Dsl-2750u Firmware.

How do I fix CVE-2019-1010155?

No fix has been published for CVE-2019-1010155 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2019-1010155 being exploited?

There is no known exploitation of CVE-2019-1010155 in the wild and no public exploit code.

Sources

Also known as CVE-2019-1010156, GHSA-6wh8-fh9f-pc2g.