CVE-2020-15895: XSS

Published Jul 22, 2020

Updated

An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage.

Affected Software

5 affected components

D-Link Dir-816l Firmware=2.06

D-Link Dir-816l Firmware=2.06.b09-beta

Dlink DIR-816L=b1

Dlink Dir-816l Firmware=2.06

Dlink Dir-816l Firmware=2.06.b09-beta

Remediation

Patch Available

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169

Event History

Jul 22, 2020

CVE Published

via MITRE·06:55 PM

Data Sourced

via MITRE·06:55 PM

Description

Frequently Asked Questions

What is CVE-2020-15895?

CVE-2020-15895 is an XSS (Cross-Site Scripting) vulnerability discovered on D-Link DIR-816L devices.

What is the severity of CVE-2020-15895?

The severity of CVE-2020-15895 is medium, with a severity value of 6.1.

How does CVE-2020-15895 affect D-Link DIR-816L devices?

CVE-2020-15895 affects D-Link DIR-816L devices 2.x before 1.10b04Beta02.

How can I fix CVE-2020-15895?

To fix CVE-2020-15895, apply the latest firmware update (version 1.10b04Beta02 or above) provided by D-Link.

Where can I find more information about CVE-2020-15895?

You can find more information about CVE-2020-15895 at the following references: [Link 1](https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/), [Link 2](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169)