CVE-2018-10618

Think of your device password like the lock on a door. This issue makes the “scrambled” version of that password too weak, so a determined attacker can crack it and learn the real password. If someone can reach your device from the network, they may be able to sign in without permission.

This matters if you run a Davolink DVW-3200N (dvw-3200n firmware) that is still on any version prior to Version 1.00.06. It’s most relevant to you if the device is reachable over a network an attacker can access (for example, from the internet). The risk is only present if an attacker can reach the device and use the remote technique described in the advisory.

This is an AMBER issue because a public exploit exists and the flaw targets password recovery remotely. While there’s no KEV listing, the likelihood of being attacked is elevated enough that you should prioritize updating to Version 1.00.06. Do not wait for symptoms—treat it as an access-control risk.

1. Confirm exposure

   • Log into the Davolink DVW-3200N and locate the current firmware version.
   • If your firmware is earlier than Version 1.00.06, you are affected.

2. Patch (preferred)

   • Upgrade the dvw-3200n firmware / DVW-3200N to Version 1.00.06 as the fixed release.
   • Use the vendor’s official firmware process and validate after the upgrade that the device reports the new firmware version.

3. If you cannot patch immediately

   • Use the workaround guidance referenced by ICS-CERT: https://ics-cert.us-cert.gov/advisories/ICSA-18-212-01
   • In the meantime, reduce exposure by restricting who can reach the device over the network (for example, block or strongly limit inbound access that would allow a remote attacker to reach the device).

4. What to monitor after changes

   • Check for unauthorized login attempts or unexpected configuration changes.
   • Verify the device remains stable after the update and that remote access controls (if used) still behave as expected.

5. Timetable

   • KEV (CISA Known Exploited Vulnerabilities): not listed in KEV, so follow your standard patch cycle—but given a public exploit exists and the flaw enables password recovery, prioritize this update before your next scheduled maintenance if at all possible.

Product: Davolink DVW-3200N (dvw-3200n firmware). Affected scope: all firmware versions prior to 1.00.06; fixed in 1.00.06. Weakness: CWE-916 (weak password hashing) leading to easily crackable password hashes. Attack vector: remote (network-reachable) password recovery; no KEV listing provided. Exploitation status: public exploit available (1 known). Patch availability: fixed version 1.00.06. Predicted likelihood: EPSS 7.1% with a falling trend (note: this is a prediction and not a guarantee).