CVE-2020-15633

Vulnerability

This vulnerability affects D-Link DIR-867, DIR-878, and DIR-882 routers. On the DIR-867 and DIR-878, affected firmware versions are v1.20B10 and v1.20B05 respectively (all Ax hardware revisions); the DIR-882 is under investigation with firmware v1.30B10 [1]. The bug resides in the handling of HNAP requests; incorrect string matching logic when accessing protected pages allows an attacker to bypass authentication by appending ?GetCAPTCHAsetting to an HNAP request [2].

Exploitation

An attacker needs to be network-adjacent (i.e., on the same local network as the router) and does not require any authentication. The exploit involves sending a specially crafted HTTP request to the router's HNAP interface with the appended string ?GetCAPTCHAsetting. No user interaction or race condition is needed [2].

Impact

Successful exploitation allows the attacker to escalate privileges and execute arbitrary code in the context of the router. This leads to full compromise of the device, including the ability to change the admin password and potentially perform further attacks on the network [1][2].

Mitigation

D-Link has released fixed firmware versions for the DIR-867 (v1.30b06 Beta Hotfix) and DIR-878 (v1.30b07 Beta Hotfix) [1]. The DIR-882 remains under investigation, and no fix is yet available; users should monitor D-Link's support page for updates [1]. Until patched, users can limit exposure by restricting access to the router's management interface to trusted devices only.