CVE-2018-12710 EXPLOIT
8.0
HIGH · CVSS 3.0 · EPSS 76.5% (pctl 100)
Patch early
A public exploit exists.
Description
An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can intercept the response from a POST request to obtain "Admin" rights due to the admin password being displayed in XML.
Scoring
| CVSS | 8.0 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 76.51% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-319 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2018-08-29 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| dlink | dir-601 |
| dlink | dir-601 firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | DLink DIR-601 - Credential Disclosure | 2018-08-30 |
References
→ the Explorer · watch your stack · NVD