PT-2020-10375 · D Link · D-Link Dir-859

Miguel Mendez Z + 3 · Published 2020-01-02 · Updated 2021-07-21 · CVE-2019-20213

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-859 versions prior to 1.07b03 beta

Description The issue allows for unauthenticated information disclosure. This can be achieved by using the AUTHORIZED GROUP=1%0a value, as demonstrated in the vpnconfig.php file.

Recommendations For versions prior to 1.07b03 beta, update to version 1.07b03 beta or later to resolve the issue. As a temporary workaround, consider restricting access to the vpnconfig.php file to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Special Elements Injection

Weakness Enumeration

CWE-863

CWE-74

Related Identifiers

CVE-2019-20213

Affected Products

D-Link Dir-859

References · 8

• 🔥 https://medium.com/@s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-es-6540f7f55b03 · Exploit
• 🔥 https://medium.com/@s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-en-faf1a9a13f3f · Exploit
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 · Vendor Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20213 · Security Note
• https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-es-6540f7f55b03 · Note
• https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-en-faf1a9a13f3f · Note