Vulnerability CVE-2020-15632
Published: 2020-07-23

Description:
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device. Was ZDI-CAN-10083.

Type:

CWE-303

 (Incorrect Implementation of Authentication Algorithm)

CVSS2 => (AV:A/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.8/10
6.4/10
6.5/10
Exploit range
Attack complexity
Authentication
Adjacent network
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10184
https://www.zerodayinitiative.com/advisories/ZDI-20-880/
Copyright 2024, cxsecurity.com

 

Back to Top