{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-17T12:08:24.739","vulnerabilities":[{"cve":{"id":"CVE-2020-8863","sourceIdentifier":"zdi-disclosures@trendmicro.com","published":"2020-03-23T21:15:12.377","lastModified":"2024-11-21T05:39:35.580","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-9470."},{"lang":"es","value":"Esta vulnerabilidad permite a atacantes adyacentes a la red omitir la autenticación sobre las instalaciones afectadas de los enrutadores D-Link DIR-867, DIR-878 y DIR-882 con versión firmware 1.10B04. No es requerida una autenticación para explotar esta vulnerabilidad. El fallo específico se presenta en el manejo de las peticiones de inicio de sesión de HNAP. El problema es debido a la falta de una implementación apropiada del algoritmo de autenticación. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios y ejecutar código en el contexto del enrutador. Fue ZDI-CAN-9470."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:C/I:C/A:C","baseScore":8.3,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.5,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","description":[{"lang":"en","value":"CWE-303"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dlink:dir-878_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.20b03","matchCriteriaId":"A46073CD-C764-4A85-A280-3E2B86CF9B16"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dlink:dir-878:-:*:*:*:*:*:*:*","matchCriteriaId":"9D288C73-F89A-47FF-AF11-143C3DFDF942"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dlink:dir-882_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.10b04","matchCriteriaId":"02445382-0BFC-4D66-A1F7-5B4C252AA234"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dlink:dir-882:-:*:*:*:*:*:*:*","matchCriteriaId":"F6ECB8ED-F3A2-4C05-8570-719ECB166B09"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dlink:dir-867_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.10b04","matchCriteriaId":"315A5B4C-31E7-4CF2-86E8-24CE1A50D025"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dlink:dir-867:-:*:*:*:*:*:*:*","matchCriteriaId":"94CB6320-D2FB-4405-8C2D-BB59798A0670"}]}]}],"references":[{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157","source":"zdi-disclosures@trendmicro.com","tags":["Third Party Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-267/","source":"zdi-disclosures@trendmicro.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-267/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]}]}}]}