Lucene search

[email protected]CVE-2020-25757

HistoryDec 15, 2020 - 8:15 p.m.

CVE-2020-25757

2020-12-1520:15:00

CWE-78

CWE-20

[email protected]

web.nvd.nist.gov

cve-2020-25757

d-link dsr

vpn routers

input validation

access controls

lua cgis

arbitrary input

system command apis

arbitrary command execution

root privileges

nvd

8.8 High

CVSS3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

8.3 High

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

41.0%

JSON

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17.

CPENameOperatorVersion
dlink:dsr-150_firmwaredlink dsr-150 firmwarele3.17
dlink:dsr-150n_firmwaredlink dsr-150n firmwarele3.17
dlink:dsr-250_firmwaredlink dsr-250 firmwarele3.17
dlink:dsr-250n_firmwaredlink dsr-250n firmwarele3.17
dlink:dsr-500_firmwaredlink dsr-500 firmwarele3.17
dlink:dsr-500n_firmwaredlink dsr-500n firmwareeq*
dlink:dsr-500ac_firmwaredlink dsr-500ac firmwarele3.17
dlink:dsr-1000_firmwaredlink dsr-1000 firmwarele3.17
dlink:dsr-1000n_firmwaredlink dsr-1000n firmwarele3.17
dlink:dsr-1000ac_firmwaredlink dsr-1000ac firmwarele3.17

CPE	Name	Operator	Version
dlink:dsr-150_firmware	dlink dsr-150 firmware	le	3.17
dlink:dsr-150n_firmware	dlink dsr-150n firmware	le	3.17
dlink:dsr-250_firmware	dlink dsr-250 firmware	le	3.17
dlink:dsr-250n_firmware	dlink dsr-250n firmware	le	3.17
dlink:dsr-500_firmware	dlink dsr-500 firmware	le	3.17
dlink:dsr-500n_firmware	dlink dsr-500n firmware	eq	*
dlink:dsr-500ac_firmware	dlink dsr-500ac firmware	le	3.17
dlink:dsr-1000_firmware	dlink dsr-1000 firmware	le	3.17
dlink:dsr-1000n_firmware	dlink dsr-1000n firmware	le	3.17
dlink:dsr-1000ac_firmware	dlink dsr-1000ac firmware	le	3.17

References

supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195

www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/

www.dlink.com/en/security-bulletin

8.8 High

CVSS3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

8.3 High

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

41.0%

JSON

Related for CVE-2020-25757

prion1 threatpost1