CVE-2017-7406
CriticalSummary
The D-Link DIR-615 device before v20.12PTb04 does not use SSL for any authenticated pages, exposing users to data theft. An attacker can monitor network traffic to capture user credentials.
Risk Assessment
The lack of SSL encryption poses a serious risk of credential theft, potentially leading to unauthorized access to organizational systems.
Recommendation
It is recommended to update the device to the latest version that supports SSL and implement additional security measures such as VPN.
Original NVD description (English source)
The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certificate. An attacker can simply monitor network traffic to steal a user's credentials and/or credentials of users being added while sniffing the traffic.