Reflected Cross-Site Scripting Vulnerability in D-Link DIR-620 Routers
CVE-2018-6212

6.1MEDIUM

Key Information:

Vendor
D-link
Status
Dir-620 Firmware
Vendor
CVE Published:
20 June 2018

Summary

The D-Link DIR-620 routers containing specific custom firmware versions are susceptible to reflected Cross-Site Scripting (XSS) vulnerabilities. This issue arises due to inadequate sanitization of user input, particularly in the 'Search' field, which allows for the execution of harmful scripts via specially crafted requests. The vulnerability is exacerbated by improper handling of the XMLHttpRequest object, potentially allowing attackers to manipulate web sessions or deliver unwanted content to users.

References

https://securityaffairs.co/wordpress/72839/hacking/d-link...
x_refsource_MISC
https://www.bleepingcomputer.com/news/security/backdoor-a...
x_refsource_MISC
https://securelist.com/backdoors-in-d-links-backyard/85530/
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.