CVE-2017-3192
CriticalSummary
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page.
Risk Assessment
A remote attacker with access to this page (potentially through an authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device, posing a serious security threat.
Recommendation
It is recommended to update the firmware to the latest version that improves the protection of administrator credentials and to implement additional protective measures such as stronger authentication mechanisms.
Original NVD description (English source)
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device.