CVE-2020-8863

CWE-303 CWE-287 — Improper Authentication3 documents3 sources

Severity

8.8HIGH

EPSS

1.8%

top 17.36%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-867 Firmware Dlink Dir-878 Firmware Dlink Dir-882 Firmware +1 more

Timeline

PublishedMar 23

Latest updateMay 24

Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of th…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5d-link/multiple_routers1.10B04

▶NVDdlink/dir-867_firmware1.10b04

▶NVDdlink/dir-878_firmware1.20b03

▶NVDdlink/dir-882_firmware1.10b04

🔴Vulnerability Details

GHSA

GHSA-6hjg-qfm2-9xc2: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 router↗2022-05-24

▶

CVEList

CVE-2020-8863: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 router↗2020-03-23

▶