ZDI-20-880: D-Link DIR-842 HNAP GetCAPTCHAsetting Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-20-880?
The severity of ZDI-20-880 is critical due to the ability for network-adjacent attackers to bypass authentication.
How do I fix ZDI-20-880?
To fix ZDI-20-880, update your D-Link DIR-842 router firmware to the latest version provided by D-Link.
Who is affected by ZDI-20-880?
ZDI-20-880 affects all installations of D-Link DIR-842 routers.
What type of attack can be executed using ZDI-20-880?
ZDI-20-880 allows attackers to exploit the router without needing authentication, enabling potential unauthorized access.
Is there a workaround for ZDI-20-880?
Currently, there are no known workarounds for mitigating the risks associated with ZDI-20-880 other than applying the firmware update.