CVE-2018-18767
CVSS V2 Low 1.9
CVSS V3 High 7
Description
An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartext. An attacker could conduct an MitM attack on the local network and very easily obtain these credentials.
Overview
- CVE ID
- CVE-2018-18767
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2018-12-20T23:29:00
- Last Modified Date
- 2023-04-26T19:36:57
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:a:d-link:mydlink_baby_camera_monitor:2.04.06:*:*:*:*:*:*:* | 1 | OR | ||
| AND | ||||
| cpe:2.3:o:d-link:dcs-825l_firmware:1.08:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:h:d-link:dcs-825l:-:*:*:*:*:*:*:* | 0 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:M/Au:N/C:P/I:N/A:N
- Access Vector
- LOCAL
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 1.9
- Severity
- LOW
- Exploitability Score
- 3.4
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- LOCAL
- Attack Compatibility
- HIGH
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 7
- Base Severity
- HIGH
- Exploitability Score
- 1
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor/ | Exploit Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2018-18767 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18767 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 16:30:38 | Added to TrackCVE | |||
| 2022-12-03 15:37:17 | 2018-12-20T23:29Z | 2018-12-20T23:29:00 | CVE Published Date | updated |
| 2022-12-03 15:37:17 | 2020-08-24T17:37:01 | CVE Modified Date | updated | |
| 2022-12-03 15:37:17 | Analyzed | Vulnerability Status | updated | |
| 2023-04-26 19:43:52 | 2023-04-26T19:36:57 | CVE Modified Date | updated |