CVE-2020-9277

An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks (e.g., modify the admin password) with no authentication.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2020-04-20

Last modified

2024-08-04

Weaknesses

CWE-287

Affected products

• Dsl-2640b Firmware (Dlink)

References

• https://raelize.com/advisories/CVE-2020-9277_D-Link-DSL-2640B_CGI-Authentication-bypass_v1.0.txt
• https://raelize.com/posts/d-link-dsl-2640b-security-advisories/
• https://www.dlink.com/en/security-bulletin