Vulnerability Details CVE-2015-7247
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup, which allows remote attackers to obtain sensitive information.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.309
EPSS Ranking 96.5%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.8
References
- http://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2016/Feb/24
- https://www.exploit-db.com/exploits/39409/
- http://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2016/Feb/24
- https://www.exploit-db.com/exploits/39409/
Products affected by CVE-2015-7247
-
cpe:2.3:h:dlink:dvg-n5402sp:-
-
cpe:2.3:o:d-link:dvg-n5402sp_firmware:w1000cn-00
-
cpe:2.3:o:d-link:dvg-n5402sp_firmware:w1000cn-03
-
cpe:2.3:o:d-link:dvg-n5402sp_firmware:w2000en-00