How severe is CVE-2018-12710?

CVE-2018-12710 has a CVSS 3.x base score of 8.0, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-12710 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 77% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-12710?

CVE-2018-12710 affects Dlink Dir-601 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-12710?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2018-12710 published?

CVE-2018-12710 was published on 2018-08-29 and last updated on 2026-06-17.

CVE-2018-12710

CVE-2018-12710 is a high-severity vulnerability in Dlink Dir-601 Firmware with a CVSS 3.x base score of 8.0. Its EPSS exploit-prediction score of 77% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-319.

Key facts

Severity: High (CVSS 3.x base score 8.0)
CVSS v2: 2.7
EPSS exploit prediction: 77% (99th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-319
Affected product: Dlink Dir-601 Firmware
Published: 2018-08-29
Last modified: 2026-06-17

Description

An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can intercept the response from a POST request to obtain "Admin" rights due to the admin password being displayed in XML.

Frequently asked questions

What is CVE-2018-12710?: An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can intercept the response from a POST request to obtain "Admin" rights due to the admin password being displayed in XML.
How severe is CVE-2018-12710?: CVE-2018-12710 has a CVSS 3.x base score of 8.0, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-12710 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 77% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-12710?: CVE-2018-12710 affects Dlink Dir-601 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-12710?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2018-12710 published?: CVE-2018-12710 was published on 2018-08-29 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:dlink:dir-601_firmware:2.02na:*:*:*:*:*:*:*

More vulnerabilities in Dlink Dir-601 Firmware

CVE-2019-16327 — Critical (CVSS 9.8): D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the…
CVE-2019-16326 — High (CVSS 8.8): D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. A remote attacker could exploit…
CVE-2018-10641 — High (CVSS 8.1): D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext.
CVE-2018-5708 — High (CVSS 8.0): An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being…
CVE-2011-4821 — Medium (CVSS 5.0): Directory traversal vulnerability in the TFTP server in D-Link DIR-601 Wireless N150 Home Router with firmware 1.02NA…

All CVEs affecting Dlink Dir-601 Firmware →

Other CWE-319 (Cleartext Transmission of Sensitive Information) vulnerabilities

CVE-2025-4378 — Critical (CVSS 10.0): Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University…
CVE-2025-47419 — Critical (CVSS 10.0): Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network…
CVE-2026-48902 — Critical (CVSS 9.8): The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't…
CVE-2025-34271 — Critical (CVSS 9.8): Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when…
CVE-2025-32880 — Critical (CVSS 9.8): An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a…
CVE-2025-26199 — Critical (CVSS 9.8): CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application…

Browse all CWE-319 (Cleartext Transmission of Sensitive Information) vulnerabilities →