CVE-2018-15517

The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows…

published January 31, 2019

CVSS
—
EPSS
44%
Percentile
98.8
In the wild
Unconfirmed
What it is

The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.44101 · 98.8th percentile
Published
2019-01-31T19:00Z
EPSS history
Timeline
  • 22 SEP 03:15Z
    EPSS moved 44% → 28%
    epss
  • 06 SEP 03:11Z
    EPSS moved 44% → 28%
    epss
  • 30 AUG 16:00Z
    EPSS moved 28% → 44%
    epss
  • 29 AUG 04:33Z
    EPSS moved 44% → 28%
    epss
  • 31 JAN 19:00Z
    The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows…
    cvelistv5