medium4.8Public exploit code
CVE-2019-19742
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting2019-12-16 · webapps · hardware
Impact
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dlink | Dir-615 Firmware | Version 20.07 |
Weakness classification
References
- NVD record
- CVE.org record
- https://infosecsanyam.blogspot.com/2019/12/d-link-dir-615-wireless-router.html
- https://medium.com/%40infosecsanyam/d-link-dir-615-wireless-router-persistent-cross-site-scripting-6ee00f5c694d
- https://pastebin.com/edit/MZV6DNg7
- https://www.dlink.com/en/security-bulletin
- https://www.exploit-db.com/exploits/47776
- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
- https://infosecsanyam.blogspot.com/2019/12/d-link-dir-615-wireless-router.html
- https://medium.com/%40infosecsanyam/d-link-dir-615-wireless-router-persistent-cross-site-scripting-6ee00f5c694d
- https://pastebin.com/edit/MZV6DNg7
- https://www.dlink.com/en/security-bulletin
- https://www.exploit-db.com/exploits/47776
- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf