CVE-2011-4723mediumunder attackCWE-312

CVE-2011-4723

Published · Updated

Follow this CVE+ Monitor DIR-300 Router

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 5.7epss 3.1%
from disclosure to weapon
Published on NVDDec 20
CISA KEV+3915d
Action required by CISAfederal deadline: 2022-09-29

The impacted product is end-of-life and should be disconnected if still in use.

In short

The D-Link DIR-300 router saves user passwords in plain text instead of encrypting them. This means anyone who gains access to the router's files can easily read and steal these passwords.

Technical detail

The device fails to implement proper password storage mechanisms (CWE-312: Cleartext Storage of Sensitive Information), storing credentials in plaintext accessible through unspecified vectors. An attacker with local or remote access to configuration files can directly recover authentication credentials without cryptographic overhead.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a