CVE-2020-27862 — Command Injection in D-link Multiple Routers

CWE-77 — Command Injection3 documents3 sources
Severity
8.8HIGHNVD
EPSS
3.4%
top 12.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
D-link Multiple RoutersDlink Dsl-2888a FirmwareDlink Dva-2800 Firmware
Timeline
PublishedFeb 12
Latest updateMay 24

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. When parsing the path parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5d-link/multiple_routersfirmware version 2.3

🔴Vulnerability Details

2
GHSA
GHSA-3fw2-qjm5-wjrf: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A firmware ver↗2022-05-24
▶
CVEList
CVE-2020-27862: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers↗2021-02-11
▶
CVE-2020-27862 — Command Injection in D-link | cvebase