Lucene search

ZdiCVE-2020-8861

HistoryFeb 22, 2020 - 12:15 a.m.

CVE-2020-8861

2020-02-2200:15:10

CWE-303

CWE-287

zdi

web.nvd.nist.gov

121

cve-2020-8861

d-link

dap-1330

wi-fi range extender

authentication bypass

hnap

router security

zdi-can-9554

nvd

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

70.5%

JSON

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of cookies. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9554.

Affected configurations

Nvd

Vulners

Node

dlinkdap-1330_firmwareRange<1.10b01

dlinkdap-1330_firmwareMatch1.10b01beta

AND

dlinkdap-1330Match-

VendorProductVersionCPE
dlinkdap-1330_firmware*cpe:2.3:o:dlink:dap-1330_firmware:*:*:*:*:*:*:*:*
dlinkdap-1330_firmware1.10b01cpe:2.3:o:dlink:dap-1330_firmware:1.10b01:beta:*:*:*:*:*:*
dlinkdap-1330-cpe:2.3:h:dlink:dap-1330:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dlink	dap-1330_firmware	*	cpe:2.3:o:dlink:dap-1330_firmware::::::::
dlink	dap-1330_firmware	1.10b01	cpe:2.3:o:dlink:dap-1330_firmware:1.10b01:beta::::::
dlink	dap-1330	-	cpe:2.3:h:dlink:dap-1330:-:::::::*

CNA Affected

[
  {
    "product": "DAP-1330",
    "vendor": "D-Link",
    "versions": [
      {
        "status": "affected",
        "version": "1.10B01 BETA"
      }
    ]
  }
]

References

supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10155

www.zerodayinitiative.com/advisories/ZDI-20-265/

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

70.5%

JSON

Related for CVE-2020-8861