CVE-2020-8863

Vulnerability

This vulnerability is an authentication bypass in the HNAP login handling of D-Link DIR-867, DIR-878, and DIR-882 routers. The flaw results from a lack of proper implementation of the authentication algorithm, specifically within the HNAP PrivateLogin function [2]. Affected firmware versions include DIR-882-US Rev. Ax FW v1.10b04 & Below, DIR-878 Rev. Ax FW v1.20b03_Hotfix & Below, and DIR-867 Rev. Ax FW v1.10b04 & Below [1]. The attack is network-adjacent and requires no authentication [2].

Exploitation

An attacker on the local network can send a specially crafted HNAP login request to the router. Because the authentication algorithm is flawed, the request is incorrectly processed, leading to authentication bypass. No prior credentials or user interaction are needed [2].

Impact

Successful exploitation allows the attacker to escalate privileges and execute arbitrary code in the context of the router [2]. This gives full control over the device, potentially compromising all network traffic traversing the router. The CVSS v3 score is 8.8, indicating high impacts on confidentiality, integrity, and availability [2].

Mitigation

D-Link has released a beta firmware update for DIR-867 (v1.20b10Beta) [1]. For DIR-878 and DIR-882, users should check the vendor advisory for corresponding updates [1]. No workarounds are available. Affected users should apply the latest firmware immediately.