VYPR
Unrated severityNVD Advisory· Published Jul 2, 2019· Updated Aug 5, 2024

CVE-2017-8406

CVE-2017-8406

Description

An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In this case, user's credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user's browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file's response and displays it inside a Textfield.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

D-Link DCS-1130 devices expose a crossdomain.xml with no restrictions, allowing remote attackers to steal cleartext credentials via cross-site flash requests.

Vulnerability

The D-Link DCS-1130 device provides a crossdomain.xml file that grants unrestricted access to the webserver from any domain [1]. This allows a hosted Flash file on any domain to make cross-domain requests to the device. Additionally, the device lacks cross-site request forgery (CSRF) protection. User credentials are stored in cleartext in the tools_admin.cgi response. Affected firmware versions are not explicitly listed, but the issue is present on D-Link DCS-1130 devices as tested in the referenced research [1].

Exploitation

An attacker must host a malicious Flash file on a domain under their control and trick a user who is currently logged into the device's web management interface into visiting that page. The Flash file can then make cross-domain requests to the device's webserver, retrieve the tools_admin.cgi response containing cleartext credentials, and display them in a text field. Because no CSRF protection exists, the attacker can also execute arbitrary actions on the device via the victim's browser [1].

Impact

Successful exploitation yields the cleartext credentials of the device's web interface. With these credentials, the attacker can log into the device and gain full administrative control, potentially leading to further compromise of the network or surveillance capabilities [1].

Mitigation

No official firmware update or patch has been disclosed by D-Link for this vulnerability. As a workaround, users should disable Adobe Flash in their browsers, restrict network access to the device's web interface to trusted hosts only, and consider replacing the device if it is end-of-life. This CVE is not listed in the Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.