Vulnerability Database

296,853

Total vulnerabilities in the database

CVE-2018-18767

An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartext. An attacker could conduct an MitM attack on the local network and very easily obtain these credentials.

  • Published: Dec 21, 2018
  • Updated: Apr 13, 2023
  • CVE: CVE-2018-18767
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7
  • AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Low
  • Score: 1.9
  • AV:L/AC:M/Au:N/C:P/I:N/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
d-link / dcs-825l_firmware 1.08 1.08.x
dlink / mydlink_baby_camera_monitor 2.04.06 2.04.06.x