CVE-2020-8863

Katalog CVE

CVSS 8.8 · High EPSS 76,7%

Kerentanan Incorrect Implementation of Authentication Algorithm pada dlink dir-878 firmware, dlink dir-882 firmware +1 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-9470.

Rincian

Terbit di NVD

23 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-303: Incorrect Implementation of Authentication Algorithm
CWE-287: Improper Authentication

EPSS (30 hari)

76,7% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157 advisory pihak ketiga
• https://www.zerodayinitiative.com/advisories/ZDI-20-267/ advisory pihak ketiga · vdb entry