An issue was discovered on D-Link DIR-816L devices 2.x... · CVE-2020-15894 · GitHub Advisory Database · GitHub

An issue was discovered on D-Link DIR-816L devices 2.x...

Moderate severity Unreviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Apr 26, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT.

References

Published by the National Vulnerability Database

Jul 22, 2020

Published to the GitHub Advisory Database May 24, 2022

Last updated Apr 26, 2023

Weaknesses

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Learn more on MITRE.

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Learn more on MITRE.