D-Link DSL 2888a - Authentication Bypass/Remote Command Execution

D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55 are vulnerable to authentication bypass issues which can lead to remote command execution. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality. id: CVE-2020-24579 info: name: D-Li...

D-Link DSL-2888A - Cookie Auth Bypass Detection (CVE-2020-24579)

Detects D-Link DSL-2888A session elevation by fetching /page/login/loginsucc.html with a random uid cookie, then /index.html with the same cookie and looking for authenticated UI markers. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2888A cookie privilege escalation / auth bypass...

CVE-2020-24578

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It has a misconfigured FTP service that allows a malicious network user to access system folders and download sensitive files such as the password hash file...

CVE-2021-33346

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

CVE-2020-27862

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by...

D-LINK DSL-2888A Arbitrary Password Change Vulnerability

The D-LINK DSL-2888A is a unified services router from D-link China.A security vulnerability exists in the D-LINK DSL-2888A, which could be exploited by attackers to make unauthorized changes to the administrator user's password...

CVE-2021-33346

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

Authorization

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

CVE-2021-33346

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

CVE-2021-33346: Missing Authentication for Critical Function

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

PT-2021-20121

Name of the Vulnerable Software and Affected Versions D-LINK DSL-2888A router affected versions not specified Description The issue concerns an arbitrary password modification vulnerability. An attacker can exploit this to modify the admin user's password without authorization. Recommendations At...

VulnCheck KEV: CVE-2020-24581

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It contains an executecmd.cgi feature that is not reachable via the web user interface that lets an authenticated user execute Operating System commands...

Logic Flaw Vulnerability in DVA-2800 Management Platform, DSL-2888A Management Platform

AUO Electronic Equipment Shanghai Co., Ltd. is a company that mainly deals with network equipment, wireless equipment, switches and other items. A logic flaw vulnerability exists in the DVA-2800 management platform and DSL-2888A management platform, which can be exploited by attackers to obtain...

D-Link DSL-2888A Privilege Escalation

The vulnerability of the D-Link DSL-2888A router’s microprogramming software web portal is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

D-Link DSL-2888A Router IP Spoofing

The vulnerability of D-Link DSL-2888A router’s microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a remote attacker to carry out IP spoofing attacks...

CVE-2020-27863

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 80...

CVE-2020-27862

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by...

CVE-2020-27863

CVE-2020-27863 affects D-Link DVA-2800 and DSL-2888A routers. The flaw is in the dhttpd service (listening on TCP port 8008 by default) where incorrect string-matching logic when accessing protected pages allows network-adjacent attackers to disclose stored credentials without authentication. The...

CVE-2020-27862

CVE-2020-27862 affects D-Link DVA-2800 and DSL-2888A routers. A flaw in the dhttpd service handling of the path parameter allows an unauthenticated, network-adjacent attacker to execute arbitrary code via a system call, with impact on the web server context. The issue is triggered by parsing the ...

CVE-2020-27862: Improper Neutralization of Special Elements used in a Command

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by...