CVE-2018-10824 in dlink dwr-116 firmware
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. The administrative password is stored in plaintext in the /tmp/csman/0 file. An attacker having a directory traversal (or LFI) can easily get full router access.
Affected software: dlink dwr-116 firmware, dlink dir-140l firmware, dlink dir-640l firmware, dlink dwr-512 firmware, dlink dwr-712 firmware, dlink dwr-912 firmware, dlink dwr-921 firmware, dlink dwr-111 firmware
Scores
- CVSS: 9.8 (critical)
- EPSS: 12.48% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2018-10-17
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.