Arbitrary Code Execution Vulnerability in D-Link DAP-1860 WiFi Extenders
CVE-2020-27865

8.8HIGH

Key Information:

Vendor
D-link
Status
Dap-1860
Vendor
CVE Published:
12 February 2021

Summary

A security vulnerability in D-Link DAP-1860 WiFi extenders allows network-adjacent attackers to execute arbitrary code. This issue arises from a flaw in the uhttpd service, which by default listens on TCP port 80, and is due to improper string matching logic when accessing protected web pages. As no authentication is required for exploitation, attackers can escalate privileges and execute malicious code within the device context, posing significant security risks.

Affected Version(s)

DAP-1860 firmware version 1.04B03

References

https://supportannouncement.us.dlink.com/announcement/pub...
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-20-1429/
x_refsource_MISC

EPSS Score

23% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

chung96vn of Vietnam Cyber Security Center
.