CVE-2019-18666

An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested. Versions through 6.12b01 have weak root credentials, allowing an attacker to gain remote root access. After 6.12b01, the root credentials were changed but the telnet service can still be started without authorization.

• CWE-306

• http://c1a.eu/dlink-dap-1360.htmlExploit, Third Party Advisory
• https://daschloer.github.io/sec/dlink-dap-1360.htmlExploit, Third Party Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10171Patch, Vendor Advisory
• http://c1a.eu/dlink-dap-1360.htmlExploit, Third Party Advisory
• https://daschloer.github.io/sec/dlink-dap-1360.htmlExploit, Third Party Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10171Patch, Vendor Advisory

Published

May 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18660The Linux kernel before 5.4.1 on powerpc allows Information …4.7
• CVE-2019-18661Fastweb FASTGate 1.0.1b devices allow partial authentication…7.5
• CVE-2019-18662An issue was discovered in YouPHPTube through 7.7. User inpu…9.8
• CVE-2019-18663A SQL injection vulnerability in a /login/forgot1 POST reque…9.8
• CVE-2019-18664The Log module in SECUDOS DOMOS before 5.6 allows XSS.5.4
• CVE-2019-18665The Log module in SECUDOS DOMOS before 5.6 allows local file…7.5
• CVE-2019-18667/usr/local/www/freeradius_view_config.php in the freeradius3…6.1
• CVE-2019-18668An issue was discovered in the Currency Switcher addon befor…6.5
• CVE-2019-1867A vulnerability in the REST API of Cisco Elastic Services Co…10
• CVE-2019-18670In the Quick Access Service (QAAdminAgent.exe) in Acer Quick…7.8
• CVE-2019-18671Insufficient checks in the USB packet handling of the ShapeS…9.8
• CVE-2019-18672Insufficient checks in the finite state machine of the Shape…7.5