Vulnerability Description
An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dlink | Dir-816L Firmware | 2.06 |
| Dlink | Dir-816L | b1 |
Related Weaknesses (CWE)
References
- https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-dThird Party Advisory
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP1PatchVendor Advisory
- https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-dThird Party Advisory
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP1PatchVendor Advisory
FAQ
What is CVE-2020-15894?
CVE-2020-15894 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utiliz...
How severe is CVE-2020-15894?
CVE-2020-15894 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15894?
Check the references section above for vendor advisories and patch information. Affected products include: Dlink Dir-816L Firmware, Dlink Dir-816L.