Incorrect Access Control in D-Link DIR-823G Firmware 1.02B03 Allows Unauthorized Access to Client Information

CVE-2019-7388 · MEDIUM Severity

AV:N/AC:L/AU:N/C:P/I:N/A:N

An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get sensitive information (such as MAC address) about all clients in the WLAN via the GetClientInfo HNAP API. Consequently, an attacker can achieve information disclosure without authentication.

Learn more about our Api Penetration Testing.