CVE-2019-20213

D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2020-01-02

Last modified

2024-08-05

Weaknesses

CWE-74, CWE-863

Affected products

• Dir-818lx Firmware (Dlink)
• Dir-822 Firmware (Dlink)
• Dir-823 Firmware (Dlink)
• Dir-859 Firmware (Dlink)
• Dir-865l Firmware (Dlink)
• Dir-868l Firmware (Dlink)
• Dir-869 Firmware (Dlink)
• Dir-880l Firmware (Dlink)
• Dir-885l Firmware (Dlink)
• Dir-885r Firmware (Dlink)
• Dir-890l Firmware (Dlink)
• Dir-890r Firmware (Dlink)
• Dir-895l Firmware (Dlink)
• Dir-895r Firmware (Dlink)

References

• https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-en-faf1a9a13f3f
• https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-es-6540f7f55b03
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147