PT-2020-16817 · D Link · Dhttpd+2

Chung96Vn + 2 · Published 2020-12-15 · Updated 2021-04-23 · CVE-2020-27862

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DVA-2800 versions prior to 2.3 D-Link DSL-2888A versions prior to 2.3

Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link routers. Authentication is not required to exploit this issue. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. When parsing the path parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of the web server.

Recommendations For D-Link DVA-2800 versions prior to 2.3, update to version 2.3 or later to resolve the issue. For D-Link DSL-2888A versions prior to 2.3, update to version 2.3 or later to resolve the issue. As a temporary workaround, consider disabling the dhttpd service until a patch is available. Restrict access to the dhttpd service, which listens on TCP port 8008 by default, to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-27862

ZDI-20-1426

Affected Products

D-Link Dsl-2888A

D-Link Dva-2800

Dhttpd

References · 6

• https://zerodayinitiative.com/advisories/ZDI-20-1426 · Security Note
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10196 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27862 · Security Note
• https://t.me/cvenotify/9842 · Telegram Post
• https://t.me/cvenotify/9991 · Telegram Post