Actively exploited · Published Dec 20, 2011 · Assigned by mitre

CVE-2011-4723

Medium 5.7 Exploited

In plain English

A medium-severity security flaw in DIR-300 Router from D-Link. Attackers are actively exploiting it in the wild (listed by CISA on September 8, 2022). The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). The impacted product is end-of-life and should be disconnected if still in use.

Severity (CVSS 3.1)5.7Medium

Exploit odds (30 days)3.1%top 12.3% of all CVEs

Exploited in the wildYesCISA KEV since Sep 8, 2022

Attack toolingNoneno public tooling known

CISA guidance

The impacted product is end-of-life and should be disconnected if still in use.

Federal agencies must remediate by Sep 29, 2022.

Official description

The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-312 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

http://en.securitylab.ru/lab/PT-2011-30 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-4723 government-resource