Dir 878 Firmware
CVE-2020-8863
HIGH
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-9470.
AnalysisAI
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-303. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-9470. Affected products include: Dlink Dir-878 Firmware, Dlink Dir-882 Firmware, Dlink Dir-867 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Dir 878 Firmware
View allD-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_48d630 function. Rated critical severity (CV
D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control. Rated critical severity (CVSS 9.8), this vulnerability
D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerabil
An issue was discovered on D-Link DIR-878 1.12B01 devices. Rated critical severity (CVSS 9.8), this vulnerability is rem
An issue was discovered on D-Link DIR-878 1.12B01 devices. Rated critical severity (CVSS 9.8), this vulnerability is rem
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. Rated high severity (CVSS 8.8), this vulnerabili
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. Rated high severity (CVSS 8.8), this vulnerabili
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. Rated high severity (CVSS 8.8), this vulnerabili
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. Rated high severity (CVSS 8.8), this vulnerabili
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. Rated high severity (CVSS 8.8), this vulnerabili
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. Rated high severity (CVSS 8.8), this vulnerabili
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. Rated high severity (CVSS 8.8), this vulnerabili
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today