60
CVE-2018-15517
PoC ×2—CVSS 3.0
8.6 high
EPSS
44%p99
Published
()
Modified
Description
The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.
- Vendors
- dlink
- Products
- central wifimanager
- Weakness
- CWE-918
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N