CVE-2017-3192

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device.

• CWE-522
• CWE-522

• https://exchange.xforce.ibmcloud.com/vulnerabilities/123292Issue Tracking, Third Party Advisory, VDB Entry
• https://www.kb.cert.org/vuls/id/553503Issue Tracking, Third Party Advisory, US Government Resource
• https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553/Third Party Advisory
• https://www.wilderssecurity.com/threads/d-link-dir-130-and-dir-330-are-vulnerable-to-authentication-bypass-and-do-not-protect-credentials.392703/Issue Tracking, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/123292Issue Tracking, Third Party Advisory, VDB Entry
• https://www.kb.cert.org/vuls/id/553503Issue Tracking, Third Party Advisory, US Government Resource
• https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553/Third Party Advisory
• https://www.wilderssecurity.com/threads/d-link-dir-130-and-dir-330-are-vulnerable-to-authentication-bypass-and-do-not-protect-credentials.392703/Issue Tracking, Third Party Advisory

Published

Dec 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-3186ACTi cameras including the D, B, I, and E series using firmw…
• CVE-2017-3187The dotCMS administration panel, versions 3.7.1 and earlier,…
• CVE-2017-3188The dotCMS administration panel, versions 3.7.1 and earlier,…
• CVE-2017-3189The dotCMS administration panel, versions 3.7.1 and earlier,…
• CVE-2017-3190Flash Seats Mobile App for Android version 1.7.9 and earlier…
• CVE-2017-3191D-Link DIR-130 firmware version 1.23 and DIR-330 firmware ve…
• CVE-2017-3193Multiple D-Link devices including the DIR-850L firmware vers…8.8
• CVE-2017-3194Pandora iOS app prior to version 8.3.2 fails to properly val…
• CVE-2017-3195Commvault Edge Communication Service (cvd) prior to version …9.8
• CVE-2017-3196PCAUSA Rawether framework does not properly validate BPF dat…
• CVE-2017-3197GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F…
• CVE-2017-3198GIGABYTE BRIX UEFI firmware does not cryptographically valid…