CVE-2020-24579: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to…

PriorityP267high8.8CVSS 3.1

AVAACLPRNUINSUCHIHAH

EXPLOIT

EPSS

10.00%

95.1th percentile

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dsl2888a_firmware	< au_2.31_v1.1.47ae55	au_2.31_v1.1.47ae55

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/execute_cmd.cgi

commandGET /cgi-bin/execute_cmd.cgi?timestamp=1589333279490&cmd=cat%20/etc/passwd HTTP/1.1

→Detect exploitation attempts by looking for POST requests to '/' with a Cookie header containing 'uid=6gPjT2ipmNz' — this is the hardcoded session cookie used to bypass authentication on D-Link DSL-2888A devices.
→Detect RCE stage by monitoring GET requests to '/cgi-bin/execute_cmd.cgi' with a 'cmd=' parameter, indicating command injection attempts post-authentication bypass.
→A successful exploit response will contain Unix passwd file patterns such as 'nobody:[x*]:65534:65534' or 'root:.*:0:0:' in the HTTP 200 response body.
→The authentication bypass is triggered by a POST to '/' with the hardcoded uid cookie; a redirect to '/page/login/login_fail.html' in the Location header may still indicate the bypass succeeded at the session level.

·The hardcoded cookie value 'uid=6gPjT2ipmNz' is specific to the PoC/nuclei template and may not represent all real-world exploitation variants; attackers could use different uid values.
·The password hash '6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b' is the SHA-256 of '1', used as a test credential in the PoC; real attacks may use different credentials.
·Vulnerability affects D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55 only; patched firmware is not vulnerable. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.05.8MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.