What is CVE-2018-18767?

CVE-2018-18767 is a high-severity vulnerability in D-Link Dcs-825l Firmware, classified under Inadequate Encryption Strength. CVSS score: 7.0/10. Published 2018-12-20.

How severe is CVE-2018-18767?

High severity. CVSS v3 base score is 7.0 out of 10.

Vulnerability in D-Link Dcs-825l Firmware

CVE-2018-18767

An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartext. An attacker could conduct an MitM attack on the local network and very easily obtain these credentials.

EPSS: 0.006 (46.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.0 (High). Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

D-link Dcs-825l_firmware — versions 1.08
Dlink Dcs-825l
Dlink Mydlink_baby_camera_monitor — versions 2.04.06
N/a — versions n/a

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-18767?: CVE-2018-18767 is a high-severity vulnerability in D-Link Dcs-825l Firmware, classified under Inadequate Encryption Strength. CVSS score: 7.0/10. Published 2018-12-20.
How severe is CVE-2018-18767?: High severity. CVSS v3 base score is 7.0 out of 10.