Cross-Site Scripting Vulnerability in D-Link DIR-615 Routers
CVE-2018-15875

6.1MEDIUM

Key Information:

Vendor

D-Link
Status
Dir-615 Firmware
Vendor
CVE Published:
25 August 2018

What is CVE-2018-15875?

A cross-site scripting (XSS) vulnerability exists in the D-Link DIR-615 router firmware version 20.07. This issue allows attackers to inject malicious JavaScript into the router's admin UPnP page through the description field in an AddPortMapping UPnP SOAP request. Successful exploitation of this vulnerability could lead to unauthorized data access, session hijacking, or further exploitation of the network's security.

References

https://github.com/reevesrs24/cve/blob/master/D-Link_DIR-...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.