#VU25573 Incorrect Comparison


Published: 2020-02-25

Vulnerability identifier: #VU25573

Vulnerability risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-8864

CWE-ID: CWE-697

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
DIR-867-US
Hardware solutions / Routers & switches, VoIP, GSM, etc
DIR-878
Hardware solutions / Routers & switches, VoIP, GSM, etc
DIR-882-US
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: D-Link

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to a lack of proper handling of empty passwords within the handling of HNAP strncmp login requests. A remote attacker on the local network can bypass authentication and reset the admin password.

An attacker can leverage this vulnerability to execute arbitrary code on the router.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

DIR-867-US: v1.10b04

DIR-878: v1.20b03_Hotfix

DIR-882-US: v1.10b04


External links
http://www.zerodayinitiative.com/advisories/ZDI-20-268/
http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability