CVE-2019-17505 Missing authorization in n/a
Unauthenticated access to web interfaces allows attackers to remotely retrieve Wi-Fi SSID and password credentials from D-Link routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-17505?
CVE-2019-17505 is a high-severity missing authorization vulnerability in n/a, published on 11 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
D-Link DAP-1320 A2-V1.21 routers have some web interfaces without authentication requirements, as demonstrated by uplink_info.xml. An attacker can remotely obtain a user's Wi-Fi SSID and password, which could be used to connect to Wi-Fi or perform a dictionary attack.
Weakness: CWE-306
Which versions are affected by CVE-2019-17505?
It affects 1 product.
Products include Dlink Dap-1320 A2 Firmware.
How do I fix CVE-2019-17505?
No fix has been published for CVE-2019-17505 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-17505 being exploited?
There is no known exploitation of CVE-2019-17505 in the wild and no public exploit code.
Sources
Also known as GHSA-6f6p-5ghg-8xmw.