d-link DSL-2888A Security Vulnerabilities

8 Vulnerabilities
Description

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2021-33346, Last Modified: 2021-06-24T16:17:00Z

References

Advisory

Modemly Security Checklist

D-Link-DSL-2888A-router-setup

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A firmware version 2.3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10912.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-27863, Last Modified: 2021-02-12T00:15:00Z

References

Advisory

Modemly Security Checklist

D-Link-DSL-2888A-router-setup

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A firmware version 2.3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. When parsing the path parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-10911.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-27862, Last Modified: 2021-02-12T00:15:00Z

References

Advisory

Modemly Security Checklist

D-Link-DSL-2888A-router-setup

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-24577, Last Modified: 2021-01-08T07:15:00Z

References

Advisory

Modemly Security Checklist

D-Link-DSL-2888A-router-setup

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. Lack of authentication functionality allows an attacker to assign a static IP address that was once used by a valid user.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-24580, Last Modified: 2020-12-22T19:47:00Z

References

Advisory

Modemly Security Checklist

D-Link-DSL-2888A-router-setup

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It contains an execute_cmd.cgi feature (that is not reachable via the web user interface) that lets an authenticated user execute Operating System commands.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-24581, Last Modified: 2020-12-22T19:47:00Z

References

Advisory

Modemly Security Checklist

D-Link-DSL-2888A-router-setup

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious network user to access system folders and download sensitive files (such as the password hash file).

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-24578, Last Modified: 2020-12-22T19:47:00Z

References

Advisory

Modemly Security Checklist

D-Link-DSL-2888A-router-setup

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-24579, Last Modified: 2020-12-22T19:47:00Z

References

Advisory

Modemly Security Checklist

D-Link-DSL-2888A-router-setup
Free Home-Networking Courses, tutorials and security checklists

USAGE: Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.