CVE-2018-10618

Vulnerability

The Davolink DVW-3200N router, all versions prior to 1.00.06, generates a weak password hash using insufficient computational effort (CWE-916). The password is stored as a base64-encoded string in the device's web interface, accessible on port 88. This weak hash can be easily cracked, allowing remote attackers to recover the plaintext password. [1][2]

Exploitation

An attacker can remotely access the device's web interface on port 88 without authentication. By sending an HTTP request to http://:88, the response contains a JavaScript variable user_passwd with a base64-encoded password. The attacker can decode this base64 string to obtain the plaintext password. The exploit requires only network access to the device; no authentication or user interaction is needed. [2]

Impact

Successful exploitation allows an attacker to obtain the device's administrative password. With this password, the attacker can gain full control over the router, potentially leading to unauthorized access, data exfiltration, or further network compromise. The CVSS v3 score is 9.8 (Critical) due to the ease of exploitation and high impact on confidentiality, integrity, and availability. [1]

Mitigation

Davolink released firmware version 1.00.06 to address this vulnerability. Users should update to this version from the vendor's website. As a workaround, minimize network exposure by not exposing the device's web interface to the internet, and use firewalls to restrict access. No known public exploits specifically target this vulnerability as of the advisory date. [1]