CVE-2015-7247
CriticalSummary
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup.
Risk Assessment
Remote attackers can obtain sensitive information, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to update the device firmware to the latest version and restrict access to backup functions only to trusted users.
Other vulnerabilities in D-Link DVG-N5402SP
See all- CVE-2015-7245High
CVE-2015-7245 describes a vulnerability in the D-Link DVG-N5402SP device with specific firmware versions that allows remote attackers to read sensitive information. This vulnerability is due to directory traversal via the errorpage parameter.
- CVE-2015-7246Critical
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of 'root' for the root account and 'tw' for the tw account, making it easier for remote attackers to gain administrative access.
Original NVD description (English source)
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup, which allows remote attackers to obtain sensitive information.