Vulnerability Description
D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. There are many affected firmware versions starting from 1.00 and above. The configuration file can be accessed remotely through: <Camera-IP>/common/info.cgi, with no authentication. The configuration file include the following fields: model, product, brand, version, build, hw_version, nipca version, device name, location, MAC address, IP address, gateway IP address, wireless status, input/output settings, speaker, and sensor settings.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| D-Link | Dcs-936L Firmware | >= 1.00 |
| Dlink | Dcs-936L | - |
| Dlink | Dcs-942L Firmware | >= 1.00 |
| Dlink | Dcs-942L | - |
| D-Link | Dcs-8000Lh Firmware | >= 1.00 |
| Dlink | Dcs-8000Lh | - |
| D-Link | Dcs-942Lb1 Firmware | >= 1.00 |
| Dlink | Dcs-942Lb1 | - |
| D-Link | Dcs-5222L Firmware | >= 1.00 |
| Dlink | Dcs-5222L | - |
| D-Link | Dcs-825L Firmware | >= 1.00 |
| Dlink | Dcs-825L | - |
| D-Link | Dcs-2630L Firmware | >= 1.00 |
| Dlink | Dcs-2630L | - |
| D-Link | Dcs-820L Firmware | >= 1.00 |
| Dlink | Dcs-820L | - |
| D-Link | Dcs-855L Firmware | >= 1.00 |
| Dlink | Dcs-855L | - |
| D-Link | Dcs-2121 Firmware | >= 1.00 |
| Dlink | Dcs-2121 | - |
Related Weaknesses (CWE)
References
- https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vuExploitThird Party Advisory
- https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vuExploitThird Party Advisory
FAQ
What is CVE-2018-18441?
CVE-2018-18441 is a vulnerability with a CVSS score of 7.5 (HIGH). D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, D...
How severe is CVE-2018-18441?
CVE-2018-18441 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-18441?
Check the references section above for vendor advisories and patch information. Affected products include: D-Link Dcs-936L Firmware, Dlink Dcs-936L, Dlink Dcs-942L Firmware, Dlink Dcs-942L, D-Link Dcs-8000Lh Firmware.