CVE-2023-36092

Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main

High · published July 31, 2023

CVSS v3.1
8.8
EPSS
2%
Percentile
76.4
In the wild
Unconfirmed
What it is

⚡ An authentication bypass in the D-Link DIR-859 could let attackers kick down your digital door! 🚪💥 Think of it like a hotel where the front desk hands out all the master keys without checking IDs — anyone can waltz into any room, even the penthouse! 🏨 This vulnerability allows remote attackers to gain escalated privileges, which could lead to unauthorized access to sensitive data, or worse, control over the entire device. It’s like handing the mic to someone in a karaoke bar who doesn't even know the lyrics — chaos could ensue!

Put simply

Think of it like a hotel where the front desk hands out all the master keys without checking IDs — anyone can waltz into any room, even the penthouse! 🏨 This vulnerability arises in the phpcgi_main function, allowing attackers to bypass authentication checks in affected D-Link firmware versions. Unfortunately, it affects products that are no longer supported, meaning no patches are forthcoming!

What to do

This vulnerability allows remote attackers to gain escalated privileges, which could lead to unauthorized access to sensitive data, or worse, control over the entire device. It’s like handing the mic to someone in a karaoke bar who doesn't even know the lyrics — chaos could ensue! If you're using the D-Link DIR-859, consider replacing it with a supported model to protect against this and other issues. Regularly audit your devices and ensure they’re updated with the latest firmware from active vendors. Don't forget to tighten your network security settings! You've got this! With a few proactive steps, you can secure your network and keep those unauthorized guests out! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01654 · 76.4th percentile
Published
2023-07-31T00:00Z
EPSS history
Timeline
  • 31 JUL 00:00Z
    Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main
    cvelistv5