Arbitrary Code Execution Vulnerability in D-Link DAP-1860 WiFi Extenders
CVE-2020-27864

8.8HIGH

Key Information:

Vendor
D-link
Status
Dap-1860
Vendor
CVE Published:
12 February 2021

Summary

A vulnerability in D-Link DAP-1860 WiFi extenders allows attackers with network access to execute arbitrary code. The flaw arises from improper validation of user-supplied strings in the HNAP service on TCP port 80. This lack of validation enables attackers to manipulate the Authorization request header and trigger system commands, enabling unauthorized code execution on the device. With no authentication required, this poses significant risks to users.

Affected Version(s)

DAP-1860 firmware version 1.04B03

References

https://www.zerodayinitiative.com/advisories/ZDI-20-1428/
x_refsource_MISC
https://supportannouncement.us.dlink.com/announcement/pub...
x_refsource_MISC

EPSS Score

15% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

chung96vn of Vietnam Cyber Security Center
.