Vulnerability identifier: #VU25572
Vulnerability risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-303
Exploitation vector: Local network
Exploit availability: No
Vulnerable software:
DIR-867-US
Hardware solutions /
Routers & switches, VoIP, GSM, etc
DIR-878
Hardware solutions /
Routers & switches, VoIP, GSM, etc
DIR-882-US
Hardware solutions /
Routers & switches, VoIP, GSM, etc
Vendor: D-Link
Description
The vulnerability allows a remote attacker to to bypass authentication process.
The vulnerability exists due to a lack of proper implementation of the authentication algorithm within the handling of HNAP PrivateLogin login requests. A remote attacker on the local network can bypass authentication and reset the admin password.
An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
DIR-867-US: v1.10b04
DIR-878: v1.20b03_Hotfix
DIR-882-US: v1.10b04
External links
http://www.zerodayinitiative.com/advisories/ZDI-20-267/
http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.