PT-2020-16818 · D Link · D-Link Dva-2800+1

Chung96Vn + 2 · Published 2020-12-15 · Updated 2021-04-23 · CVE-2020-27863

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DVA-2800 versions prior to firmware version 2.3 D-Link DSL-2888A versions prior to firmware version 2.3

Description This issue allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link routers. Authentication is not required to exploit this issue. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this issue to disclose stored credentials, leading to further compromise.

Recommendations For D-Link DVA-2800 versions prior to firmware version 2.3, update to firmware version 2.3 or later to resolve the issue. For D-Link DSL-2888A versions prior to firmware version 2.3, update to firmware version 2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the dhttpd service on TCP port 8008 until a patch is available.

Fix

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

Related Identifiers

CVE-2020-27863

ZDI-20-1427

Affected Products

D-Link Dsl-2888A

D-Link Dva-2800

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-27863 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27863 · Vendor Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10196 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-1427 · Security Note
• https://t.me/cvenotify/9835 · Telegram Post