high7.5
CVE-2019-15655
D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server.
Impact
D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dlink | Dsl-2875al Firmware | through 1.00.05 |