Skip to main content

Dir 655 Firmware CVE-2019-13560

CRITICAL
Credentials Management Errors (CWE-255)
2019-07-11 cve@mitre.org
Authentication Bypass D-Link Dir 655 Firmware
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 11, 2019 - 15:15 nvd
CRITICAL 9.8

DescriptionNVD

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter.

AnalysisAI

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-255. D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter. Affected products include: Dlink Dir-655 Firmware. Version information: before 3.02.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Dir 655 Firmware

View all
CVE-2019-16920 CRITICAL POC
9.8 Sep 27

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. Rated
CVE-2019-13561 CRITICAL POC
9.8 Jul 11

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharac
CVE-2025-6158 HIGH POC
8.8 Jun 17

Critical stack-based buffer overflow vulnerability in the HTTP POST request handler (function sub_AC78) of D-Link DIR-66
CVE-2019-13563 HIGH POC
8.8 Jul 11

D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console. Rated high severity (CVSS 8
CVE-2019-13562 MEDIUM POC
6.1 Jul 11

D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr para
CVE-2014-9518 MEDIUM POC
4.3 Jan 05

Cross-site scripting (XSS) vulnerability in login.cgi in D-Link router DIR-655 (rev Bx) with firmware before 2.12b01 all

Same weakness CWE-255 – Credentials Management Errors

View all
CVE-2014-1812 HIGH POC
8.8
CVE-2016-7456 CRITICAL POC
9.8
CVE-2012-1493 HIGH POC
7.8
CVE-2012-4933 HIGH POC
7.8
CVE-2013-4786 HIGH POC
7.5
CVE-2013-3502 MEDIUM POC
6.5
CVE-2015-7251 CRITICAL POC
9.8
CVE-2013-6884 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2019-13560 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy