CVE-2020-24577

published 2021-01-08

CVE-2020-24577: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dsl-2888a_firmware	< au_2.31_v1.1.47ae55	au_2.31_v1.1.47ae55

CWE-312