CVE-2018-10618

mediumpriority · attend · 52EPSS 0.100 · 96 %ileexploit · PoCEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

10.00% (96th) EPSS

CVSS 5 · medium

Is it mine?

4 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-26

Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationDVW-3200Ncisa_csaf_ot
Davolink has produced a new firmware version for the device that can be downloaded from:
http://www.davolink.co.kr/sys/bbs/board.php?bo_table=0403&wr_id=50

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5–9.8

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.09.3criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-916USprimaryCWE-916US

exploits (1)

Public proof-of-concept and weaponised exploit code.

EDB-45076Davolink DVW 3200 Router - Password DisclosurePoC · exploit_db

affected products (4)

Products and version ranges known to be affected.

DVW-3200N: all version prior to Version 1.00.06all versionscisa_csaf_otUS
Davolink DVW-3200N< 1.00.06cisa_csaf_otUS
Davolink DVW-3200N≤ all version prior to Version 1.00.06enisa_euvdEU
davolink dvw-3200n firmware< 1.00.06nvdUScpe:2.3:o:davolink:dvw-3200n_firmware:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-18-212-01Davolink DVW-3200N2018-07-31icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability may result in a remote attacker obtaining the password to the device.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

published 2018-08-01modified 2026-06-17

related (162)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2005-0408US	critical9.8	4.74% (92nd)	Exploit	2005-02-14
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileg…
CVE-2023-33243US	high8.1	4.42% (91st)	Exploit	2023-06-15
RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext passwo…
CVE-2024-3183US	high8.1	2.05% (81st)	Exploit	2024-06-12
A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it fro…
CVE-2018-9233US	high7.8	1.65% (76th)	Exploit	2018-04-05
Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers t…
CVE-2021-38314US	medium5.3	29.0% (98th)	Exploit	2021-09-02
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `re…

+157 more

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan