This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835.
References
| Link | Resource |
|---|---|
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10186 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-20-881/ | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
26 Apr 2023, 18:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Dlink dir-882
Dlink dir-867 Dlink dir-878 Dlink |
|
| CPE | cpe:2.3:h:d-link:dir-878:-:*:*:*:*:*:*:* cpe:2.3:h:d-link:dir-867:-:*:*:*:*:*:*:* |
cpe:2.3:h:dlink:dir-867:-:*:*:*:*:*:*:* cpe:2.3:h:dlink:dir-882:-:*:*:*:*:*:*:* cpe:2.3:h:dlink:dir-878:-:*:*:*:*:*:*:* |
Information
Published : 2020-07-23 21:15
Updated : 2023-12-10 13:27
NVD link : CVE-2020-15633
Mitre link : CVE-2020-15633
CVE.ORG link : CVE-2020-15633
JSON object : View
Products Affected
d-link
- dir-882_firmware
- dir-867_firmware
- dir-878_firmware
dlink
- dir-867
- dir-882
- dir-878
CWE
CWE-288
Authentication Bypass Using an Alternate Path or Channel