CVE-2020-15633

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:d-link:dir-867_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-867:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:d-link:dir-878_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-878:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:d-link:dir-882_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-882:-:*:*:*:*:*:*:*

History

26 Apr 2023, 18:55

Type Values Removed Values Added
CPE cpe:2.3:h:d-link:dir-867:-:*:*:*:*:*:*:*
cpe:2.3:h:d-link:dir-878:-:*:*:*:*:*:*:*
cpe:2.3:h:d-link:dir-882:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-867:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-878:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-882:-:*:*:*:*:*:*:*

Information

Published : 2020-07-23 21:15

Updated : 2024-02-04 21:00


NVD link : CVE-2020-15633

Mitre link : CVE-2020-15633

CVE.ORG link : CVE-2020-15633


JSON object : View

Products Affected

dlink

  • dir-878
  • dir-867
  • dir-882

d-link

  • dir-878_firmware
  • dir-882_firmware
  • dir-867_firmware
CWE
CWE-288

Authentication Bypass Using an Alternate Path or Channel