CVE-2020-8864

CWE-6973 documents3 sources

Severity

8.8HIGH

EPSS

11.3%

top 6.46%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-867 Firmware Dlink Dir-878 Firmware Dlink Dir-882 Firmware +1 more

Timeline

PublishedMar 23

Latest updateMay 24

Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9471.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5d-link/multiple_routers1.10B04

▶NVDdlink/dir-867_firmware1.10b04

▶NVDdlink/dir-878_firmware1.20b03

▶NVDdlink/dir-882_firmware1.10b04

🔴Vulnerability Details

GHSA

GHSA-w7pr-c6mr-6w7j: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 router↗2022-05-24

▶

CVEList

CVE-2020-8864: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 router↗2020-03-23

▶