ZDI-CAN-11856: D-Link DAP-2020 errorpage External Control of File Name Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the errorpage request parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-11856?
ZDI-CAN-11856 has been classified as a high severity vulnerability due to its potential for information disclosure.
How do I fix ZDI-CAN-11856?
To fix ZDI-CAN-11856, update your D-Link DAP-2020 to the latest firmware version provided by D-Link.
Who is affected by ZDI-CAN-11856?
ZDI-CAN-11856 affects installations of D-Link DAP-2020 Wi-Fi access points.
Can ZDI-CAN-11856 be exploited remotely?
Yes, ZDI-CAN-11856 can be exploited by network-adjacent attackers without requiring authentication.
What type of vulnerability is ZDI-CAN-11856?
ZDI-CAN-11856 is an information disclosure vulnerability stemming from a flaw in the processing of CGI scripts.