CVE-2020-8862

high · 8.8

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the lack of proper password checking. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-10082.

8.8

CVSS

13.3%

EPSS (exploit prob.)

96th

EPSS percentile

2020-02-22

Published

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-697CWE-287

Affected products

Vendor	Product	Affected versions
dlink	dap-2610_firmware	<= 2.01rc067
dlink	dap-2610	all versions

Check a specific version with /api/v1/cve/match.

References

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10154
https://www.zerodayinitiative.com/advisories/ZDI-20-266/
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10154
https://www.zerodayinitiative.com/advisories/ZDI-20-266/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-8862