CVE-2020-27863

MEDIUM Year: 2020
CVSS v3 Score
6.5
Medium
CVSS v2 Score
3.3
Low
Weakness Type
CWE-288
View all →

Vulnerability Description

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10912.

Related Vulnerabilities

CVE-2020-13185

MEDIUM
CVSS:6.5(Medium)

Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attac...

CWE-2882020

CVE-2020-1637

MEDIUM
CVSS:6.5(Medium)

A vulnerability in Juniper Networks SRX Series device configured as a Junos OS Enforcer device may allow a user to access network resources that are not permitted by a UAC policy. This issue might occ...

CWE-2882020

CVE-2020-17409

MEDIUM
CVSS:6.5(Medium)

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220, R6020, JNR3210, and WNR2020 routers with firmwar...

CWE-2882020

CVE-2022-1067

MEDIUM
CVSS:6.5(Medium)

Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting.

CWE-2882022

CVE-2022-23722

MEDIUM
CVSS:6.5(Medium)

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another exi...

CWE-2882022

CVE-2023-20018

MEDIUM
CVSS:6.5(Medium)

A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This...

CWE-2882023