CVE-2020-25759

Katalog CVE

CVSS 8.8 · High EPSS 2,3%

Kerentanan Improper Input Validation pada dlink dsr-150 firmware, dlink dsr-150n firmware +8 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacker to execute arbitrary commands, due to a lack of validation of inputs provided in multipart HTTP POST requests.

Rincian

Terbit di NVD

15 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195 advisory vendor
• https://www.dlink.com/en/security-bulletin advisory vendor
• https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/ advisory pihak ketiga