PT-2020-16460 · D Link · Dsr-250N

Published 2020-10-08 · Updated 2023-04-26 · CVE-2020-26567

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions D-Link DSR-250N versions prior to 3.17B

Description An issue was discovered where the CGI script upgradeStatusReboot.cgi can be accessed without authentication. Any access to this script reboots the device, rendering it unusable for several minutes.

Recommendations For versions prior to 3.17B, update to version 3.17B or later to resolve the issue. As a temporary workaround, consider restricting access to the upgradeStatusReboot.cgi script until a patch is available.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-26567

Affected Products

Dsr-250N

References · 8

• 🔥 https://exploit-db.com/exploits/48863 · Exploit
• 🔥 https://redteam-pentesting.de/advisories/rt-sa-2020-002 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Oct/14 · Exploit
• 🔥 http://packetstormsecurity.com/files/159516/D-Link-DSR-250N-Denial-Of-Service.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-26567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26567 · Security Note
• https://t.me/cybersecuritytechnologies/1883 · Telegram Post
• https://t.me/cvenotify/49114 · Telegram Post