« Volver al listado

CVE-2018-6213

Estado: ModificadaCrítica (9.8)—

In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there is a hardcoded password of anonymous for the admin account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

D-link — Dir-620 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-6213",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-06-20T16:29:00.437",
  "references": [
    {
      "url": "http://www.securitynewspaper.com/2018/05/25/d-link-dir-620-routers-critical-vulnerabilities/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://securelist.com/backdoors-in-d-links-backyard/85530/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://securityaffairs.co/wordpress/72839/hacking/d-link-dir-620-flaws.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.bleepingcomputer.com/news/security/backdoor-account-found-in-d-link-dir-620-routers/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitynewspaper.com/2018/05/25/d-link-dir-620-routers-critical-vulnerabilities/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://securelist.com/backdoors-in-d-links-backyard/85530/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://securityaffairs.co/wordpress/72839/hacking/d-link-dir-620-flaws.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.bleepingcomputer.com/news/security/backdoor-account-found-in-d-link-dir-620-routers/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there is a hardcoded password of anonymous for the admin account."
    },
    {
      "lang": "es",
      "value": "En el servidor web de los dispositivos D-Link DIR-620 con una determinada variante personalizada (por proveedor de Internet) del firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0 y 2.0.22, hay una contraseña embebida \"anonymous\" para la cuenta de administrador."
    }
  ],
  "lastModified": "2026-06-17T02:01:31.470",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:d-link:dir-620_firmware:1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDC6FED4-DAB2-4B30-AD72-EBA8DEBE867D"
            },
            {
              "criteria": "cpe:2.3:o:d-link:dir-620_firmware:1.0.37:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3766E4D-10C1-41AE-BB3C-F72CC46272C8"
            },
            {
              "criteria": "cpe:2.3:o:d-link:dir-620_firmware:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "135FB2AD-C1D4-465F-8F29-DCC537B5864A"
            },
            {
              "criteria": "cpe:2.3:o:d-link:dir-620_firmware:1.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1B25AAD-A8DA-41AC-8C45-C015D5B2FD7D"
            },
            {
              "criteria": "cpe:2.3:o:d-link:dir-620_firmware:1.3.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD36F6E0-ADB5-42F2-B434-CE661587C53D"
            },
            {
              "criteria": "cpe:2.3:o:d-link:dir-620_firmware:1.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22C527A9-677A-4F50-8D3B-405E66F3F434"
            },
            {
              "criteria": "cpe:2.3:o:d-link:dir-620_firmware:2.0.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7AEB349-D1FF-4696-9FE3-69B2EF7554AA"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-620:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1DF4C296-C8AA-4197-B280-ED5D22C70156"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}