Vulnerabilities > CVE-2020-15632 - Unspecified vulnerability in Dlink Dir-842 Firmware

CVSS 8.8 - HIGH

Attack vector

ADJACENT_NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

low complexity

dlink

NVD

Published: 2020-07-23

Updated: 2024-11-21

Summary

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device. Was ZDI-CAN-10083.

Vulnerable Configurations

Part	Description	Count
OS	Dlink Dlink DIR 842 Firmware - Dlink DIR 842 Firmware 1.05B02 Dlink DIR 842 Firmware 2.00B06 Dlink DIR 842 Firmware 2.01B04 Dlink DIR 842 Firmware 2.02B01 Dlink DIR 842 Firmware 3.00B18 Dlink DIR 842 Firmware 3.01B05 Dlink DIR 842 Firmware 3.10B05 Dlink DIR 842 Firmware 3.11B05 Dlink DIR 842 Firmware 3.12B01 Dlink DIR 842 Firmware 3.13B05 Dlink DIR 842 Firmware 3.13B09	12
Hardware	Dlink Dlink DIR 842 C	1

Summary

Vulnerable Configurations

References