CVE-2014-7857

Critical

Published: 25/08/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter and setting the spawned session's cookie to username=admin.

Risk Assessment

Attackers can gain full access to the devices, potentially leading to data theft or deletion, as well as system takeover.

Recommendation

It is recommended to update the firmware to the latest version to mitigate this vulnerability and implement additional security measures such as monitoring access logs.

Original NVD description (English source)

D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter, and setting the spawned session's cookie to username=admin.