CVE-2020-8864

Vulnerability

The vulnerability is an authentication bypass flaw in the HNAP login mechanism of D-Link DIR-867, DIR-878, and DIR-882 routers running firmware versions v1.10B04 and below [1]. It stems from improper handling of empty passwords during HNAP login requests, allowing an attacker to bypass authentication without any credentials [2].

Exploitation

A network-adjacent attacker can trigger the flaw by sending a crafted HNAP login request with an empty password field. No authentication or user interaction is required, as the bug lies in the login handling code that incorrectly validates an empty string [2]. The attack can be performed from the local network segment without any prior access [1].

Impact

Successful exploitation allows the attacker to bypass authentication entirely and execute arbitrary code on the router with root privileges. This compromises the confidentiality, integrity, and availability of the device and the network it controls, enabling full remote compromise [2].

Mitigation

D-Link has released a beta firmware fix: v1.20b10Beta for DIR-867-US Rev. Ax [1]. No fixes were mentioned for DIR-878 and DIR-882 in the advisory; users should check the vendor's support page for updates. Until a stable patch is applied, restricting physical and network access to the router's LAN interface is recommended. The vulnerability is not listed in CISA's KEV at the time of writing.