CVE-2020-25757
A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.13% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20, CWE-78
- Affected
- dlink/dsr-150 firmware · dlink/dsr-150n firmware · dlink/dsr-250 firmware · dlink/dsr-250n firmware · dlink/dsr-500 firmware · dlink/dsr-500n firmware · dlink/dsr-500ac firmware · dlink/dsr-1000 firmware · dlink/dsr-1000n firmware · dlink/dsr-1000ac firmware
- Source
- cve@mitre.org
References
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195Vendor Advisory
- https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/Third Party Advisory
- https://www.dlink.com/en/security-bulletinVendor Advisory
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195Vendor Advisory
- https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/Third Party Advisory
- https://www.dlink.com/en/security-bulletinVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.