PT-2017-16938
CVE-2017-6190
·
Published
2017-04-10
·
Updated
2017-08-16
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
D-Link DWR-116 device with firmware before V1.05b09
Description
The issue allows remote attackers to read arbitrary files via a .. (dot dot) in a "GET /uir/" request. This is a directory traversal vulnerability in the web interface.
Recommendations
For firmware before V1.05b09, update to V1.05b09 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the .. (dot dot) sequence in the "GET /uir/" request until the issue is resolved.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾