PT-2020-1849 · D Link · D-Link Dir-867+2
Chung96Vn
·
Published
2020-02-21
·
Updated
2021-04-23
·
CVE-2020-8863
CVSS v3.1
8.8
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
D-Link DIR-867 versions 1.10B04
D-Link DIR-878 versions 1.10B04
D-Link DIR-882 versions 1.10B04
Description
The issue is related to errors in the implementation of the authentication algorithm in the HNAP Private Login component of the D-Link DIR-867, DIR-878, and DIR-882 routers. This allows a remote attacker to bypass authentication and potentially escalate privileges, executing code in the context of the router. The specific flaw exists within the handling of HNAP login requests, resulting from the lack of proper implementation of the authentication algorithm.
Recommendations
For D-Link DIR-867 version 1.10B04, update the firmware to a version that fixes the authentication algorithm implementation issue.
For D-Link DIR-878 version 1.10B04, update the firmware to a version that fixes the authentication algorithm implementation issue.
For D-Link DIR-882 version 1.10B04, update the firmware to a version that fixes the authentication algorithm implementation issue.
As a temporary workaround, consider restricting access to the HNAP login requests to minimize the risk of exploitation.
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
D-Link Dir-867
D-Link Dir-878
D-Link Dir-882