CVE-2020-15632CWE-303

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers

High · published July 23, 2020

CVSS v3.0
8.8
EPSS
3%
Percentile
89.0
In the wild
Unconfirmed
What it is

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device. Was ZDI-CAN-10083.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03472 · 89.0th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2020-07-23T20:45Z
EPSS history
Timeline
  • 23 JUL 20:45Z
    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers
    cvelistv5