ZDI-21-205: D-Link DAP-2020 errorpage External Control of File Name Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the errorpage request parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-21-205?
The severity of ZDI-21-205 is classified as high due to its potential for disclosing sensitive information without authentication.
How do I fix ZDI-21-205?
To fix ZDI-21-205, ensure that the D-Link DAP-2020 firmware is updated to the latest version provided by the vendor.
Who is affected by ZDI-21-205?
ZDI-21-205 affects installations of D-Link DAP-2020 Wi-Fi access points that have not been patched against this vulnerability.
What type of attacks can be performed using ZDI-21-205?
ZDI-21-205 allows network-adjacent attackers to exploit the vulnerability to disclose sensitive information.
Is authentication required to exploit ZDI-21-205?
No, authentication is not required to exploit ZDI-21-205, making it particularly dangerous.