What is the CVSS score of CVE-2013-7005?

CVE-2013-7005 has a CVSS 2.0 base score of 4.9 (Medium). CVSS vector: AV:L/AC:L/Au:N/C:C/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2013-7005?

Yes, a public proof-of-concept exploit is available for CVE-2013-7005. Prioritise patching immediately. EPSS: 0.0%.

Dsr 150 Firmware CVE-2013-7005

MEDIUM

Information Exposure (CWE-200)

2013-12-19 cve@mitre.org

Information Disclosure D-Link Dsr 150 Firmware Dsr 150 Dsr 250 Firmware Dsr 250 Dsr 1000N Firmware Dsr 1000N Dsr 150N Firmware Dsr 150N Dsr 500 Firmware Dsr 500 Dsr 1000 Firmware Dsr 1000 Dsr 250N Firmware Dsr 500N Firmware Dsr 500N

4.9

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:L/AC:L/Au:N/C:C/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:C/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 19, 2013 - 04:24 cve.org

MEDIUM 4.9

DescriptionCVE.org

D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 stores account passwords in cleartext, which allows local users to obtain sensitive information by reading the Users[#]["Password"] fields in /tmp/teamf1.cfg.ascii.

AnalysisAI

D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware. Rated medium severity (CVSS 4.9), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 stores account passwords in cleartext, which allows local users to obtain sensitive information by reading the Users[#]["Password"] fields in /tmp/teamf1.cfg.ascii. Affected products include: Dlink Dsr-150 Firmware, Dlink Dsr-150, Dlink Dsr-250 Firmware, Dlink Dsr-250, Dlink Dsr-1000N Firmware. Version information: before 1.08.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.