CVE-2020-25757

🗓️ 15 Dec 2020 19:27:32Reported by mitreType

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2020-25757	10 Dec 202013:07	–	circl
CNNVD	Multiple D-Link Router Products Input Validation Error Vulnerability	15 Dec 202000:00	–	cnnvd
Cvelist	CVE-2020-25757	15 Dec 202019:27	–	cvelist
EUVD	EUVD-2020-18408	7 Oct 202500:30	–	euvd
NVD	CVE-2020-25757	15 Dec 202020:15	–	nvd
Prion	Input validation	15 Dec 202020:15	–	prion
RedhatCVE	CVE-2020-25757	22 May 202515:50	–	redhatcve
ThreatPost	D-Link Routers at Risk for Remote Takeover from Zero-Day Flaw	9 Dec 202014:56	–	threatpost

NVD

Node

dlink dsr-150_firmwareRange≤3.17

AND

dlink dsr-150Match-

Node

dlink dsr-150n_firmwareRange≤3.17

AND

dlink dsr-150nMatch-

Node

dlink dsr-250_firmwareRange≤3.17

AND

dlink dsr-250Match-

Node

dlink dsr-250n_firmwareRange≤3.17

AND

dlink dsr-250nMatch-

Node

dlink dsr-500_firmwareRange≤3.17

AND

dlink dsr-500Match-

Node

dlink dsr-500n_firmware

AND

dlink dsr-500nMatch-

Node

dlink dsr-500ac_firmwareRange≤3.17

AND

dlink dsr-500acMatch-

Node

dlink dsr-1000_firmwareRange≤3.17

AND

dlink dsr-1000Match-

Node

dlink dsr-1000n_firmwareRange≤3.17

AND

dlink dsr-1000nMatch-

Node

dlink dsr-1000ac_firmwareRange≤3.17

AND

dlink dsr-1000acMatch-

Source	Link
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
dlink	www.dlink.com/en/security-bulletin
digitaldefense	www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/

21 Nov 2024 05:18Current

8.8High risk

Vulners AI Score8.8

CVSS 28.3

CVSS 3.18.8

EPSS0.00518