VAR-201402-0418
Vulnerability from variot - Updated: 2023-12-18 13:29Cross-site request forgery (CSRF) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 allows remote attackers to hijack the authentication of administrators for requests that modify configuration settings via unspecified vectors. D-Link DAP-2253 is a router device of D-Link. Attackers can use these vulnerabilities to execute arbitrary script code in the context browser of the affected site, steal cookie-based authentication, perform unauthorized operations, leak or modify sensitive information, and there may be other forms of attacks. Attackers may exploit these issues to gain unauthorized access to restricted content by bypassing intended security restrictions or to obtain sensitive information that may aid in launching further attacks. Other attacks may also be possible. D-Link DAP-2253 running firmware 1.26rc55 and prior are vulnerable. D-Link DAP-2253 Access Point is a wireless access point product of D-Link. A1) with firmware 1.26rc55 and earlier
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201402-0418",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dap 2253",
"scope": "lte",
"trust": 1.0,
"vendor": "d link",
"version": "1.26rc55"
},
{
"model": "dap 2253",
"scope": "eq",
"trust": 1.0,
"vendor": "d link",
"version": "a1"
},
{
"model": "dap-2553",
"scope": "eq",
"trust": 0.8,
"vendor": "d link",
"version": "revision a1"
},
{
"model": "dap-2553",
"scope": "lt",
"trust": 0.8,
"vendor": "d link",
"version": "1.30"
},
{
"model": "dap-2553",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dap 2253",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.26rc55"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006009"
},
{
"db": "NVD",
"id": "CVE-2013-7320"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-065"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:d-link:dap_2253_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.26rc55",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:d-link:dap_2253:a1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7320"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported these issues.",
"sources": [
{
"db": "BID",
"id": "64593"
}
],
"trust": 0.3
},
"cve": "CVE-2013-7320",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2013-7320",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2013-15307",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-67322",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-7320",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2013-15307",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201402-065",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-67322",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"db": "VULHUB",
"id": "VHN-67322"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006009"
},
{
"db": "NVD",
"id": "CVE-2013-7320"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-065"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 allows remote attackers to hijack the authentication of administrators for requests that modify configuration settings via unspecified vectors. D-Link DAP-2253 is a router device of D-Link. Attackers can use these vulnerabilities to execute arbitrary script code in the context browser of the affected site, steal cookie-based authentication, perform unauthorized operations, leak or modify sensitive information, and there may be other forms of attacks. \nAttackers may exploit these issues to gain unauthorized access to restricted content by bypassing intended security restrictions or to obtain sensitive information that may aid in launching further attacks. Other attacks may also be possible. \nD-Link DAP-2253 running firmware 1.26rc55 and prior are vulnerable. D-Link DAP-2253 Access Point is a wireless access point product of D-Link. A1) with firmware 1.26rc55 and earlier",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7320"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006009"
},
{
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"db": "CNNVD",
"id": "CNNVD-201312-314"
},
{
"db": "BID",
"id": "64593"
},
{
"db": "BID",
"id": "64297"
},
{
"db": "VULHUB",
"id": "VHN-67322"
}
],
"trust": 3.33
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-7320",
"trust": 3.1
},
{
"db": "DLINK",
"id": "SAP10006",
"trust": 2.6
},
{
"db": "SECUNIA",
"id": "56022",
"trust": 2.3
},
{
"db": "BID",
"id": "64297",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006009",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201402-065",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2013-15307",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201312-314",
"trust": 0.6
},
{
"db": "BID",
"id": "64593",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-67322",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"db": "VULHUB",
"id": "VHN-67322"
},
{
"db": "BID",
"id": "64593"
},
{
"db": "BID",
"id": "64297"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006009"
},
{
"db": "NVD",
"id": "CVE-2013-7320"
},
{
"db": "CNNVD",
"id": "CNNVD-201312-314"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-065"
}
]
},
"id": "VAR-201402-0418",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"db": "VULHUB",
"id": "VHN-67322"
}
],
"trust": 1.3363635999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-15307"
}
]
},
"last_update_date": "2023-12-18T13:29:46.805000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SAP10006",
"trust": 0.8,
"url": "http://securityadvisories.dlink.com/security/publication.aspx?name=sap10006"
},
{
"title": "D-Link DAP-2553 has multiple vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/41826"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006009"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-67322"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006009"
},
{
"db": "NVD",
"id": "CVE-2013-7320"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "http://securityadvisories.dlink.com/security/publication.aspx?name=sap10006"
},
{
"trust": 2.3,
"url": "http://secunia.com/advisories/56022"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/64297"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-7320"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-7320"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/us/en/business-solutions/wireless/access-points/access-points/dap-2553-wireless-n600-dual-band-poe-access-point"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"db": "VULHUB",
"id": "VHN-67322"
},
{
"db": "BID",
"id": "64593"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006009"
},
{
"db": "NVD",
"id": "CVE-2013-7320"
},
{
"db": "CNNVD",
"id": "CNNVD-201312-314"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-065"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"db": "VULHUB",
"id": "VHN-67322"
},
{
"db": "BID",
"id": "64593"
},
{
"db": "BID",
"id": "64297"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006009"
},
{
"db": "NVD",
"id": "CVE-2013-7320"
},
{
"db": "CNNVD",
"id": "CNNVD-201312-314"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-065"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-12-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"date": "2014-02-06T00:00:00",
"db": "VULHUB",
"id": "VHN-67322"
},
{
"date": "2013-11-26T00:00:00",
"db": "BID",
"id": "64593"
},
{
"date": "2013-11-26T00:00:00",
"db": "BID",
"id": "64297"
},
{
"date": "2014-02-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-006009"
},
{
"date": "2014-02-06T16:10:59.093000",
"db": "NVD",
"id": "CVE-2013-7320"
},
{
"date": "2013-11-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201312-314"
},
{
"date": "2014-02-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201402-065"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-02-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-15307"
},
{
"date": "2014-02-21T00:00:00",
"db": "VULHUB",
"id": "VHN-67322"
},
{
"date": "2015-03-19T09:23:00",
"db": "BID",
"id": "64593"
},
{
"date": "2013-11-26T00:00:00",
"db": "BID",
"id": "64297"
},
{
"date": "2014-02-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-006009"
},
{
"date": "2014-02-21T05:06:05.407000",
"db": "NVD",
"id": "CVE-2013-7320"
},
{
"date": "2013-12-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201312-314"
},
{
"date": "2014-02-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201402-065"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201312-314"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-065"
}
],
"trust": 1.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DAP-2553 Access Point Cross-site request forgery vulnerability in some firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-006009"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201312-314"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…