CVE-2020-27863 MEDIUM

CVE-2020-27863

Vendor D-Link

Product Multiple Routers

Weakness CWE-288

Published February 11, 2021

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10912.

Key dates

02Disclosure timeline

February 11, 2021 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-27863 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/288.html

Related vulnerabilities

04Related CVE

CVE-2025-1283 Dingtian DT-R0 Series Authentication Bypass Using an Alternate Path or Channel CVE-2026-45217 WordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability CVE-2026-41308 Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication CVE-2026-42654 WordPress Wallet System for WooCommerce plugin <= 2.7.5 - Broken Authentication vulnerability CVE-2026-35642 OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass