CVE-2020-15632

CWE-3033 documents3 sources
Severity
8.8HIGH
EPSS
4.2%
top 11.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Dlink Dir-842 FirmwareD-link Dir-842
Timeline
PublishedJul 23
Latest updateMay 24

Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device. Was ZDI-CAN-10083.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5d-link/dir-8423.13B05

Patches

Patch: supportannouncement.us.dlink.com ↗Patch: supportannouncement.us.dlink.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-f2jh-cwgj-5mqc: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3↗2022-05-24
▶
CVEList
CVE-2020-15632: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3↗2020-07-23
▶