PT-2020-5594 · D Link · Dsl-2888A

Harold Zang · Published 2020-05-26 · Updated 2023-04-26 · CVE-2020-24579

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DSL-2888A versions prior to AU 2.31 V1.1.47ae55

Description An issue was discovered that allows an unauthenticated attacker to bypass authentication and access authenticated pages and functionality. This is related to weaknesses in the authentication procedure. The exploitation of this issue may allow a remote attacker to elevate their privileges.

Recommendations For versions prior to AU 2.31 V1.1.47ae55, update the firmware to version AU 2.31 V1.1.47ae55 or later to resolve the issue. As a temporary workaround, consider restricting access to authenticated pages and functionality until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2021-01228

CVE-2020-24579

Affected Products

Dsl-2888A

References · 12

• 🔥 https://trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce · Exploit
• https://osv.dev/vulnerability/CVE-2020-24579 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24579 · Security Note
• https://bdu.fstec.ru/vul/2021-01228 · Security Note
• https://t.me/cibsecurity/21181 · Telegram Post
• https://t.me/cvenotify/7572 · Telegram Post
• https://t.me/cvenotify/7617 · Telegram Post
• https://vuldb.com/?id.166695 · Note
• https://t.me/cvenotify/49116 · Telegram Post
• https://trustwave.com/en-us/resources/security-resources/security-advisories · Note
• https://t.me/cybersecuritytechnologies/2670 · Telegram Post
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10194 · Note