CVE-2021-39615 Hardcoded credentials in n/a
Hard-coded credentials in D-Link DSR-500N allow attackers to gain SSH or Telnet access to the underlying operating system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39615?
CVE-2021-39615 is a critical vulnerability in n/a, published on 23 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the cleartext password of the identified hash value, he will be able to log in via SSH or Telnet and thus gain access to the underlying embedded Linux operating system on the device. Fixed in version 2.12/2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Weakness: CWE-798
Which versions are affected by CVE-2021-39615?
It affects 1 product.
Products include Dlink Dsr-500n Firmware.
How do I fix CVE-2021-39615?
No fix has been published for CVE-2021-39615 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-39615 being exploited?
There is no known exploitation of CVE-2021-39615 in the wild and no public exploit code.
Sources
Also known as GHSA-849p-5hj4-w47q.