https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 21:36:10 +0000 https://cve.radiocsirt.org/vuln/cnvd-2019-23331 cnvd-2019-23331 https://cve.radiocsirt.org/vuln/cnvd-2019-23331 https://cve.radiocsirt.org/vuln/euvd-2026-75319 EUVD-2026-75319 https://cve.radiocsirt.org/vuln/euvd-2026-75319 https://cve.radiocsirt.org/vuln/fkie_cve-2017-8415 <p>An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string &#34;admin&#34; and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only.</p> <p>An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string &#34;admin&#34; and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-8415 https://cve.radiocsirt.org/vuln/ghsa-3qrh-88fr-gvx6 <p>An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string &#34;admin&#34; and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only.</p> <p>An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string &#34;admin&#34; and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only.</p> https://cve.radiocsirt.org/vuln/ghsa-3qrh-88fr-gvx6 https://cve.radiocsirt.org/vuln/gsd-2017-8415 gsd-2017-8415 https://cve.radiocsirt.org/vuln/gsd-2017-8415