{"id":"CVE-2018-18441","aliases":["EUVD-2018-10169","GHSA-p3jp-mxwf-g5m3"],"status":"published","title":"D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration....","description":"D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. There are many affected firmware versions starting from 1.00 and above. The configuration file can be accessed remotely through: \u003cCamera-IP\u003e/common/info.cgi, with no authentication. The configuration file include the following fields: model, product, brand, version, build, hw_version, nipca version, device name, location, MAC address, IP address, gateway IP address, wireless status, input/output settings, speaker, and sensor settings.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02238,"percentile":0.82915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-200"],"published":"2018-12-20T22:00:00Z","modified":"2026-06-17T01:47:18Z","exploits":[{"source":"pocgithub","id":"bayazid-bit/CVE-2018-18441-exploit","title":"bayazid-bit/CVE-2018-18441-exploit","date":"2025-09-28","url":"https://github.com/bayazid-bit/CVE-2018-18441-exploit"}],"products":[{"vendor":"d-link","product":"dcs-2102_firmware"},{"vendor":"d-link","product":"dcs-2121_firmware"},{"vendor":"d-link","product":"dcs-2630l_firmware"},{"vendor":"d-link","product":"dcs-5222l_firmware"},{"vendor":"d-link","product":"dcs-5222lb1_firmware"},{"vendor":"d-link","product":"dcs-8000lh_firmware"},{"vendor":"d-link","product":"dcs-8100lh_firmware"},{"vendor":"d-link","product":"dcs-820l_firmware"},{"vendor":"d-link","product":"dcs-825l_firmware"},{"vendor":"d-link","product":"dcs-855l_firmware"},{"vendor":"d-link","product":"dcs-936l_firmware"},{"vendor":"d-link","product":"dcs-942lb1_firmware"},{"vendor":"dlink","product":"dcs-5020l_firmware"},{"vendor":"dlink","product":"dcs-5030l_firmware"},{"vendor":"dlink","product":"dcs-930l_firmware"},{"vendor":"dlink","product":"dcs-932l_firmware"},{"vendor":"dlink","product":"dcs-933l_firmware"},{"vendor":"dlink","product":"dcs-942l_firmware"}],"references":[{"url":"https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18441"},{"url":"https://github.com/advisories/GHSA-p3jp-mxwf-g5m3"}],"sources":{"cve":[{"id":"CVE-2018-18441","description":"D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. There are many affected firmware versions starting from 1.00 and above. The configuration file can be accessed remotely through: \u003cCamera-IP\u003e/common/info.cgi, with no authentication. The configuration file include the following fields: model, product, brand, version, build, hw_version, nipca version, device name, location, MAC address, IP address, gateway IP address, wireless status, input/output settings, speaker, and sensor settings.","status":"published","published":"2018-12-20T22:00:00Z","modified":"2024-08-05T11:08:21.874Z","updated_at":"2026-11-02T14:35:11.799349Z"}],"euvd":[{"id":"EUVD-2018-10169","description":"D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. There are many affected firmware versions starting from 1.00 and above. The configuration file can be accessed remotely through: \u003cCamera-IP\u003e/common/info.cgi, with no authentication. The configuration file include the following fields: model, product, brand, version, build, hw_version, nipca version, device name, location, MAC address, IP address, gateway IP address, wireless status, input/output settings, speaker, and sensor settings.","status":"published","published":"2018-12-20T22:00:00Z","modified":"2024-08-05T11:08:21Z","updated_at":"2026-11-03T02:39:36.317092Z"}],"ghsa":[{"id":"GHSA-p3jp-mxwf-g5m3","title":"D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration....","description":"D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. There are many affected firmware versions starting from 1.00 and above. The configuration file can be accessed remotely through: \u003cCamera-IP\u003e/common/info.cgi, with no authentication. The configuration file include the following fields: model, product, brand, version, build, hw_version, nipca version, device name, location, MAC address, IP address, gateway IP address, wireless status, input/output settings, speaker, and sensor settings.","status":"published","published":"2022-05-14T01:34:20Z","modified":"2023-02-02T05:03:53Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:51:44.834559Z"}],"nvd":[{"id":"CVE-2018-18441","description":"D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. There are many affected firmware versions starting from 1.00 and above. The configuration file can be accessed remotely through: \u003cCamera-IP\u003e/common/info.cgi, with no authentication. The configuration file include the following fields: model, product, brand, version, build, hw_version, nipca version, device name, location, MAC address, IP address, gateway IP address, wireless status, input/output settings, speaker, and sensor settings.","status":"published","published":"2018-12-20T23:29:00.707Z","modified":"2026-06-17T01:47:18.583Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:50.99633Z"}]}}