NetSight
IP …
high8.8

CVE-2020-8864

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi…

Impact

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9471.

Affected products

VendorProductAffected versions
DlinkDir-878 Firmware
through 1.20b03
DlinkDir-882 Firmware
through 1.10b04
DlinkDir-867 Firmware
through 1.10b04

Weakness classification

CWE-697

References