CVE-2019-15655 is a critical vulnerability affecting D-Link DSL-2875AL devices running firmware versions through 1.00.05, allowing for unauthenticated password disclosure. An attacker can exploit this by sending a crafted request to the web management server, which saves the configuration file containing cleartext passwords. Rated with a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with no authentication or user interaction required, leading to a complete compromise of sensitive information. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the straightforward nature of the attack poses a significant risk to unpatched devices.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.00.05CPE matchmatch criteria | cpe:2.3:o:dlink:dsl-2875al_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.