An issue exists in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartext. An attacker could conduct an MitM attack on the local network and very easily obtain these credentials.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
dlink mydlink baby camera monitor 2.04.06 |
||
d-link dcs-825l_firmware 1.08 |
Vulmon