Details of VAR-201710-0058

ID

VAR-201710-0058

CVE

CVE-2016-10699

TITLE

D-Link DSL-2740E Device cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-008858

DESCRIPTION

D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logins and passwords with script tags in them. Because there is no sanitization in the input fields, an unaware logged-in administrator may be a victim when checking the router logs. D-Link DSL-2740E The device contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. D-LinkDSL-2740E is a wireless router product of D-Link. A security vulnerability exists in the D-LinkDSL-2740E1.00_BG_20150720 version that caused the program to fail to properly filter user-submitted input. A remote attacker could exploit this vulnerability to execute arbitrary script code in a browser. D-Link DSL-2740E ADSL Router is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks

Trust: 2.52

sources: NVD: CVE-2016-10699 // JVNDB: JVNDB-2016-008858 // CNVD: CNVD-2017-36202 // BID: 101622 // VULHUB: VHN-89501

IOT TAXONOMY

category:

['IoT', 'Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-36202

AFFECTED PRODUCTS

vendor:	d link	model:	dsl-2740e	scope:	eq	version:	1.00_bg_20150720	Trust: 1.4
vendor:	dlink	model:	dsl-2740e	scope:	eq	version:	1.00_bg_20150720	Trust: 1.0
vendor:	d link	model:	dsl-2740e 1.00 bg 20150720	scope:	-	version:	-	Trust: 0.9

sources: CNVD: CNVD-2017-36202 // BID: 101622 // JVNDB: JVNDB-2016-008858 // CNNVD: CNNVD-201710-1304 // NVD: CVE-2016-10699

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-10699
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2016-10699
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2017-36202
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201710-1304
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-89501
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-10699
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-36202
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-89501
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-10699
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-36202 // VULHUB: VHN-89501 // JVNDB: JVNDB-2016-008858 // CNNVD: CNNVD-201710-1304 // NVD: CVE-2016-10699

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-89501 // JVNDB: JVNDB-2016-008858 // NVD: CVE-2016-10699

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201710-1304

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201710-1304

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-008858

PATCH

title:	Top Page	url:	http://www.dlink.com/uk/en/	Trust: 0.8
title:	D-LinkDSL-2740EHTML injection vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/107901	Trust: 0.6
title:	D-Link DSL-2740E Security vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=76046	Trust: 0.6

sources: CNVD: CNVD-2017-36202 // JVNDB: JVNDB-2016-008858 // CNNVD: CNNVD-201710-1304

EXTERNAL IDS

db:	NVD	id:	CVE-2016-10699	Trust: 3.4
db:	BID	id:	101622	Trust: 2.6
db:	JVNDB	id:	JVNDB-2016-008858	Trust: 0.8
db:	CNNVD	id:	CNNVD-201710-1304	Trust: 0.7
db:	CNVD	id:	CNVD-2017-36202	Trust: 0.6
db:	VULHUB	id:	VHN-89501	Trust: 0.1

sources: CNVD: CNVD-2017-36202 // VULHUB: VHN-89501 // BID: 101622 // JVNDB: JVNDB-2016-008858 // CNNVD: CNNVD-201710-1304 // NVD: CVE-2016-10699

REFERENCES

url:	https://www.trustwave.com/resources/security-advisories/advisories/twsl2016-018/?fid=8411	Trust: 3.4
url:	http://www.securityfocus.com/bid/101622	Trust: 2.3
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-10699	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2016-10699	Trust: 0.8
url:	http://www.d-link.com	Trust: 0.3

sources: CNVD: CNVD-2017-36202 // VULHUB: VHN-89501 // BID: 101622 // JVNDB: JVNDB-2016-008858 // CNNVD: CNNVD-201710-1304 // NVD: CVE-2016-10699

CREDITS

Jose Tozo of Trustwave

Trust: 0.3

sources: BID: 101622

SOURCES

db:	CNVD	id:	CNVD-2017-36202
db:	VULHUB	id:	VHN-89501
db:	BID	id:	101622
db:	JVNDB	id:	JVNDB-2016-008858
db:	CNNVD	id:	CNNVD-201710-1304
db:	NVD	id:	CVE-2016-10699

LAST UPDATE DATE

2025-04-20T23:32:49.798000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-36202	date:	2017-12-05T00:00:00
db:	VULHUB	id:	VHN-89501	date:	2017-11-18T00:00:00
db:	BID	id:	101622	date:	2017-12-19T22:36:00
db:	JVNDB	id:	JVNDB-2016-008858	date:	2017-11-22T00:00:00
db:	CNNVD	id:	CNNVD-201710-1304	date:	2023-04-27T00:00:00
db:	NVD	id:	CVE-2016-10699	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-36202	date:	2017-12-05T00:00:00
db:	VULHUB	id:	VHN-89501	date:	2017-10-31T00:00:00
db:	BID	id:	101622	date:	2016-09-16T00:00:00
db:	JVNDB	id:	JVNDB-2016-008858	date:	2017-11-22T00:00:00
db:	CNNVD	id:	CNNVD-201710-1304	date:	2017-10-31T00:00:00
db:	NVD	id:	CVE-2016-10699	date:	2017-10-31T07:29:00.237