Details of VAR-201908-0584

ID

VAR-201908-0584

CVE

CVE-2019-13263

TITLE

D-link DIR-825AC G1 Vulnerability related to input validation on devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-008736

DESCRIPTION

D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field. D-link DIR-825AC G1 The device contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-Link DIR-825 is an AC 1200 Wi-Fi dual-band Gigabit (LAN / WAN) router. D-link DIR-825AC G1 has a hidden tunnel vulnerability across routers. D-Link DIR-825AC G1 is a wireless router made by Taiwan D-Link Company

Trust: 2.25

sources: NVD: CVE-2019-13263 // JVNDB: JVNDB-2019-008736 // CNVD: CNVD-2019-39559 // VULHUB: VHN-145092

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2019-39559

AFFECTED PRODUCTS

vendor:	dlink	model:	dir-825\/ac g1	scope:	eq	version:	-	Trust: 1.0
vendor:	d link	model:	dir-825/ac g1	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dir-825 g1	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2019-39559 // JVNDB: JVNDB-2019-008736 // NVD: CVE-2019-13263

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-13263
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-13263
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2019-39559
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201908-2075
value:	HIGH
Trust: 0.6
VULHUB:	VHN-145092
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-13263
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2019-39559
severity:	MEDIUM
baseScore:	4.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.5
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-145092
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-13263
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-13263
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2019-39559 // VULHUB: VHN-145092 // JVNDB: JVNDB-2019-008736 // CNNVD: CNNVD-201908-2075 // NVD: CVE-2019-13263

PROBLEMTYPE DATA

problemtype:	CWE-669	Trust: 1.1
problemtype:	CWE-20	Trust: 0.9

sources: VULHUB: VHN-145092 // JVNDB: JVNDB-2019-008736 // NVD: CVE-2019-13263

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201908-2075

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201908-2075

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-008736

PATCH

title:

Top Page

url:

https://www.dlink.com/en/consumer

Trust: 0.8

sources: JVNDB: JVNDB-2019-008736

EXTERNAL IDS

db:	NVD	id:	CVE-2019-13263	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-008736	Trust: 0.8
db:	CNNVD	id:	CNNVD-201908-2075	Trust: 0.7
db:	CNVD	id:	CNVD-2019-39559	Trust: 0.6
db:	VULHUB	id:	VHN-145092	Trust: 0.1

sources: CNVD: CNVD-2019-39559 // VULHUB: VHN-145092 // JVNDB: JVNDB-2019-008736 // CNNVD: CNNVD-201908-2075 // NVD: CVE-2019-13263

REFERENCES

url:	https://www.usenix.org/system/files/woot19-paper_ovadia.pdf	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-13263	Trust: 2.0
url:	https://orenlab.sise.bgu.ac.il/publications/crossrouter	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13263	Trust: 0.8

sources: CNVD: CNVD-2019-39559 // VULHUB: VHN-145092 // JVNDB: JVNDB-2019-008736 // CNNVD: CNNVD-201908-2075 // NVD: CVE-2019-13263

SOURCES

db:	CNVD	id:	CNVD-2019-39559
db:	VULHUB	id:	VHN-145092
db:	JVNDB	id:	JVNDB-2019-008736
db:	CNNVD	id:	CNNVD-201908-2075
db:	NVD	id:	CVE-2019-13263

LAST UPDATE DATE

2024-11-23T22:21:33.246000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-39559	date:	2019-11-07T00:00:00
db:	VULHUB	id:	VHN-145092	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-008736	date:	2019-09-05T00:00:00
db:	CNNVD	id:	CNNVD-201908-2075	date:	2020-08-25T00:00:00
db:	NVD	id:	CVE-2019-13263	date:	2024-11-21T04:24:34.470

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2019-39559	date:	2019-11-07T00:00:00
db:	VULHUB	id:	VHN-145092	date:	2019-08-27T00:00:00
db:	JVNDB	id:	JVNDB-2019-008736	date:	2019-09-05T00:00:00
db:	CNNVD	id:	CNNVD-201908-2075	date:	2019-08-27T00:00:00
db:	NVD	id:	CVE-2019-13263	date:	2019-08-27T18:15:10.623