CVE-2020-27600: OS Command Injection

Published Apr 2, 2021

Updated

HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter.

Affected Software

2 affected components

Dlink Dir-846 Firmware=a1_100.26

Dlink Dir-846

Event History

Apr 2, 2021

CVE Published

via MITRE·08:11 PM

Data Sourced

via MITRE·08:11 PM

Description

Frequently Asked Questions

What is CVE-2020-27600?

CVE-2020-27600 is a vulnerability in D-Link Router DIR-846 firmware that allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter.

How severe is CVE-2020-27600?

CVE-2020-27600 has a severity level of 9.8 (Critical).

How can remote attackers exploit CVE-2020-27600?

Remote attackers can exploit CVE-2020-27600 by injecting shell metacharacters in the ssid0 or ssid1 parameter to execute arbitrary commands.

Which version of D-Link Router DIR-846 firmware is affected?

The vulnerability affects D-Link Router DIR-846 firmware version A1_100.26.

How can I fix CVE-2020-27600?

To fix CVE-2020-27600, users should update their D-Link Router DIR-846 firmware to a non-vulnerable version as recommended by D-Link.