60
CVE-2018-15517
- CVSS 3.0
- 8.6 high
- EPSS
- 44%p99
- Published
- ·
- Modified
Description · NVD
The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.
- Vendors
- dlink
- Products
- central wifimanager
- Weakness
- CWE-918
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N