Test ID:	1.3.6.1.4.1.25623.1.0.106017
Category:	Web application abuses
Title:	D-Link DNS Devices Authentication Bypass Vulnerability
Summary:	Authentication bypass vulnerability in D-Link DNS devices.
Description:	Summary: Authentication bypass vulnerability in D-Link DNS devices. Vulnerability Insight: D-Link DNS series devices allow attackers to bypass authentication. The users root and nobody have empty passwords which can't be changed in the user interface. Since login attempts to these and other users are only blocked over client side Javascript access can be gained through a direct call to login_mgr.cgi. Vulnerability Impact: An unauthenticated attacker can gain access to the devices user interface with the privileges of root and nobody. This can lead to a complete compromise of the device. Affected Software/OS: DNS-320, DNS-320L, DNS-325, DNS-327L. Other devices, models or versions might be also affected. Solution: Update the Firmware to the latest available version. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.