Vulnerability in D-Link Dcs-825l Firmware
CVE-2018-18767
An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartext. An attacker could conduct an MitM attack on the local network and very easily obtain these credentials.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (48.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- D-Link Dcs-825l Firmware — versions 1.08
- Dlink Dcs-825l
- Dlink Mydlink Baby Camera Monitor — versions 2.04.06
Weakness classification (CWE)
References
- dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabi… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-18767?
- CVE-2018-18767 is a high-severity vulnerability in D-Link Dcs-825l Firmware, classified under Inadequate Encryption Strength. CVSS score: 7.0/10. Published 2018-12-20.
- How severe is CVE-2018-18767?
- High severity. CVSS v3 base score is 7.0 out of 10.