CVE-2020-25759

An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacker to execute arbitrary commands, due to a lack of validation of inputs provided in multipart HTTP POST requests.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dsr-150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-150:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:dlink:dsr-150n_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-150n:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:dlink:dsr-250_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-250:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:dlink:dsr-250n_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-250n:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:dlink:dsr-500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-500:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:dlink:dsr-500n_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-500n:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:dlink:dsr-500ac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-500ac:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:dlink:dsr-1000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-1000:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:dlink:dsr-1000n_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-1000n:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:dlink:dsr-1000ac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsr-1000ac:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-12-15 20:15

Updated : 2024-02-28 18:08


NVD link : CVE-2020-25759

Mitre link : CVE-2020-25759

CVE.ORG link : CVE-2020-25759


JSON object : View

Products Affected

dlink

  • dsr-1000n_firmware
  • dsr-500ac
  • dsr-150_firmware
  • dsr-1000
  • dsr-250n
  • dsr-1000n
  • dsr-500_firmware
  • dsr-500n_firmware
  • dsr-150n
  • dsr-500n
  • dsr-500
  • dsr-250
  • dsr-500ac_firmware
  • dsr-1000ac_firmware
  • dsr-1000ac
  • dsr-150
  • dsr-250n_firmware
  • dsr-250_firmware
  • dsr-150n_firmware
  • dsr-1000_firmware
CWE
CWE-20

Improper Input Validation

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')