CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-33346
https://notcve.org/view.php?id=CVE-2021-33346
There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization. Se presenta una vulnerabilidad de modificación arbitraria de la contraseña en un producto router D-LINK DSL-2888A. Un atacante puede utilizar esta vulnerabilidad para modificar la contraseña del usuario administrador sin autorización • https://github.com/EmYiQing/CVE https://www.dlink.com/en/security-bulletin • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 2CVE-2020-24577
https://notcve.org/view.php?id=CVE-2020-24577
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI. Se detectó un problema en los dispositivos D-Link DSL-2888A con versiones de firmware anteriores a AU_2.31_V1.1.47ae55. La aplicación One Touch revela información confidencial, tal y como la contraseña de inicio de sesión de administrador en el hash y el nombre de usuario de la conexión del proveedor de Internet y la contraseña en texto sin cifrar, en el cuerpo de respuesta de la aplicación para un URI /tmp/var/passwd o /tmp/home/wan_stat • https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce https://www.trustwave.com/en-us/resources/security-resources/security-advisories https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-27862 – D-Link Multiple Routers dhttpd Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-27862
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. When parsing the path parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the web server. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10196 https://www.zerodayinitiative.com/advisories/ZDI-20-1426 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-27863 – D-Link Multiple Routers dhttpd Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-27863
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10196 https://www.zerodayinitiative.com/advisories/ZDI-20-1427 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •