CVE-2017-7852
Published Apr 24, 2017
Last updated 2 years ago
Overview
- Description
- D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to *, thus accepting requests from any domain. If a victim logged into the camera's web console visits a malicious site hosting a malicious Flash file from another Browser tab, the malicious Flash file then can send requests to the victim's DCS series Camera without knowing the credentials. An attacker can host a malicious Flash file that can retrieve Live Feeds or information from the victim's DCS series Camera, add new admin users, or make other changes to the device. Known affected devices are DCS-933L with firmware before 1.13.05, DCS-5030L, DCS-5020L, DCS-2530L, DCS-2630L, DCS-930L, DCS-932L, and DCS-932LB1.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 6.8
- Impact score
- 6.4
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-352
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2230l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "734A019E-883B-4BE7-AB10-9D50C5C8A8CC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2230l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF503030-B07A-432F-9DBC-2003DBDEFC39",
"versionEndIncluding": "1.03.01"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2310l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7F1DE1F9-002A-4EC9-A482-881A91A121AC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2310l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D489F126-1717-44B2-AB54-BE7E6E4FD78F",
"versionEndIncluding": "1.08.01"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2332l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F4D3B4CD-44F9-46D1-870E-5429D73ECCEA"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2332l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7DCC13A1-D70D-4426-B847-99226E670946",
"versionEndIncluding": "1.08.01"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-6010l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF861B2D-7E7A-4056-A0B9-3F739A4485B1",
"versionEndIncluding": "1.15.01"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-6010l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "71C9F4DA-5433-42A8-B321-C2B6CD88822C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7010l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98BE2B94-BAE6-4F60-8347-D065DD2A3F0D",
"versionEndIncluding": "1.08.01"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7010l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F88405D4-6FB3-4E30-B6E8-48F6039FDECD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2530l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3691A9F1-647D-40D8-80C8-399EF01A9A4C",
"versionEndIncluding": "1.00.21"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2530l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "40A05FF4-4847-41C2-946A-F8043481E11F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-930l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21C37B4A-C985-4449-AF18-57948CDBE39C",
"versionEndIncluding": "1.15.04"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-930l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F24CD425-B7C1-4828-AC1A-1A72A3559746"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-930l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D370AB5-388C-4368-B679-51CFBA8D5294",
"versionEndIncluding": "2.13.15"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-930l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F24CD425-B7C1-4828-AC1A-1A72A3559746"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-932l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38BC9948-BF0A-4A1C-9562-4B36E53CC97A",
"versionEndIncluding": "1.13.04"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-932l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "34775D9A-F16B-43C5-A8F4-88C0F9760364"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-932l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9787F3F-4454-4B37-BADE-D700D14C63B2",
"versionEndIncluding": "2.13.15"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-932l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "34775D9A-F16B-43C5-A8F4-88C0F9760364"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-934l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3D6B86A-5F52-44C1-A7C7-2B970CDFF6E7",
"versionEndIncluding": "1.04.15"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-934l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E24CC28E-1446-48A3-83FD-ED135D5C8C6C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-942l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74070833-5E71-47CF-8F02-6D97FCCB55FB",
"versionEndIncluding": "1.27"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-942l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7D04A473-87F2-4B8C-8FBF-BC02CF0DA8FD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-942l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "804D8789-BE83-46F2-8EFB-50C7D2C14823",
"versionEndIncluding": "2.11.03"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-942l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7D04A473-87F2-4B8C-8FBF-BC02CF0DA8FD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-931l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "117AF393-E45E-4A89-B308-7BEF5979D006",
"versionEndIncluding": "1.13.05"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-931l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0E1F2866-F7C1-4EC5-8C46-3DE78CD04AFB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-933l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "486B9DE3-4CB3-48BA-9F3A-A486179FC782",
"versionEndIncluding": "1.13.05"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-933l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "414352B6-6760-4D78-91FC-5198F62981E9"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5009l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59E19806-A378-456E-9F3E-54CE6B519E1B",
"versionEndIncluding": "1.07.05"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5009l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B932DF47-F157-445E-8C52-0AAF1377E5C1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5010l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EECBA0D6-CBEA-46C2-8ED9-571531F22408",
"versionEndIncluding": "1.13.05"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5010l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D57DC437-96C8-41BD-8120-1949BFD3A8EC"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5020l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9150CEBC-2762-4376-BBBE-A13A4BFF17FA",
"versionEndIncluding": "1.13.05"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5020l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B00912CC-6F2F-4F13-BED1-0DCD4DF965DB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5000l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E927400D-887A-4F12-B671-672D0FEC4DB7",
"versionEndIncluding": "1.02.02"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5000l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "397F0BCA-7A8B-43A1-939D-27127384228D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5025l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D407D08-9881-47BA-9C84-32581E84D38B",
"versionEndIncluding": "1.02.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5025l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C4B9D7B6-8185-4A44-88B6-2DE8937539A9"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5030l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "174E05E4-DE3D-4A2C-BEC7-C171E0BE28AF",
"versionEndIncluding": "1.01.06"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5030l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3BC9A416-A780-4532-8221-5674A7911198"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2210l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F4773DB8-F8ED-4841-8861-570D9A49E08F"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2210l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FC05AE2-089F-4FA5-A7E7-31B6AA9D5F7B",
"versionEndIncluding": "1.03.01"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2136l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64DF2031-114C-4A20-A45A-F2A89B422064",
"versionEndIncluding": "1.04.01"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2136l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "12486E64-E79B-4A3A-B1C6-2E3C33D8B299"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2132l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB304076-7631-48EA-ABF0-F541C341ECBC",
"versionEndIncluding": "1.08.01"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2132l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8B5F1984-B87D-400C-A9FE-8543C40986B2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7000l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E305FA72-FC97-4AA0-9508-D8B8961A511C",
"versionEndIncluding": "1.04.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7000l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E7A989B0-848F-48C4-A14A-098FD6007DF8"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-6212l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "706DA20A-8EF6-4B64-B486-07CDC9F25DB1",
"versionEndIncluding": "1.00.12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-6212l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F3B662B4-2A1D-4ECB-9B71-BC6B6524625C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5029l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B73E1F0F-71E7-4108-A3E9-34A70351DC05"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5029l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AECC1DA1-433C-4A40-A00E-5CBADA21D2FE",
"versionEndIncluding": "1.12.00"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2310l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7F1DE1F9-002A-4EC9-A482-881A91A121AC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2310l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19717483-8BBE-4313-AC13-5D56EEB6084D",
"versionEndIncluding": "2.03.00"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2330l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CC9A8D3B-14B8-4CF7-8339-6504A21B7E98"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2330l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6AB59BB-3D79-45BF-9AA3-62C44A7F25E7",
"versionEndIncluding": "1.13.00"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2132l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8B5F1984-B87D-400C-A9FE-8543C40986B2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2132l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "10E216B5-995F-4AA0-83EC-99AD9B87F582",
"versionEndIncluding": "2.12.00"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5222l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AED5E89C-1745-4C93-A891-F6C819C9E7B7",
"versionEndIncluding": "2.12.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5222l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "97C4B9CD-6029-4B92-8785-1349292EDD69"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]