Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-15633

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835.

Published

2020-07-23T21:15:12.033

Last Modified

2024-11-21T05:05:54.503

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:A/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

6.5

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-288
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System d-link dir-867_firmware ≤ 1.20b10 Yes
Hardware dlink dir-867 - No
Operating System d-link dir-878_firmware ≤ 1.20b05 Yes
Hardware dlink dir-878 - No
Operating System d-link dir-882_firmware - Yes
Hardware dlink dir-882 - No
References