CVE-2018-7698

{"id": "CVE-2018-7698", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2018-03-05T19:29:01.050", "references": [{"url": "https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera's stream and make changes without the user's knowledge."}, {"lang": "es", "value": "Se ha descubierto un problema en D-Link mydlink+ 3.8.5 build 259 para dispositivos DCS-933L 1.05.04 y DCS-934L 1.05.04. La aplicaci\u00f3n mydlink+ env\u00eda el nombre de usuario y la contrase\u00f1a para las c\u00e1maras D-Link conectadas (como DCS-933L y DCS-934L) sin cifrar de la aplicaci\u00f3n a la c\u00e1mara. Esto permite que atacantes obtengan estas credenciales y obtengan el control de la c\u00e1mara, incluyendo la capacidad de ver la transmisi\u00f3n de la c\u00e1mara y realizar cambios sin que el usuario lo sepa."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:d-link:mydlink\\+:3.8.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96486576-2060-4900-B62C-B9E709DBB389"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}