CVE-2020-15894

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/	Third Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:dlink:dir-816l_firmware:2.06:::::::*
	cpe:2.3:o:dlink:dir-816l_firmware:2.06.b09:beta::::::

cpe:2.3:h:dlink:dir-816l:b1:*:*:*:*:*:*:*

History

26 Apr 2023, 18:55

Type	Values Removed	Values Added
CPE	cpe:2.3:h:d-link:dir-816l:b1:::::::*	cpe:2.3:h:dlink:dir-816l:b1:::::::*
CWE	~~CWE-200~~	CWE-306

Information

Published : 2020-07-22 19:15

Updated : 2024-02-04 21:00

NVD link : CVE-2020-15894

Mitre link : CVE-2020-15894

CVE.ORG link : CVE-2020-15894

JSON object : View

Products Affected

dlink

dir-816l
dir-816l_firmware

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2020-15894", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-07-22T19:15:12.710", "references": [{"url": "https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos D-Link DIR-816L versiones 2.x anteriores a 1.10b04Beta02. Se presenta una funci\u00f3n de administraci\u00f3n expuesta en el archivo getcfg.php, que puede ser utilizada para llamar a varios servicios. Puede ser usada por un atacante para recuperar informaci\u00f3n confidencial, tal y como credenciales de inicio de sesi\u00f3n de administrador, al establecer el valor de _POST_SERVICES en la cadena de consulta para DEVICE.ACCOUNT"}], "lastModified": "2023-11-08T22:49:55.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-816l_firmware:2.06:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1817EE29-D782-4A98-A478-20BDA559C5CE"}, {"criteria": "cpe:2.3:o:dlink:dir-816l_firmware:2.06.b09:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABE7E66F-20B2-4A39-A845-03E5FBBD9E2A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-816l:b1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "637B2D4B-0EA7-4E30-9B2B-77484D701042"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}