Headline
CVE-2022-43620: ZDI-22-1494
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-16142.
November 3rd, 2022
D-Link DIR-1935 HNAP PrivateLogin Authentication Bypass Vulnerability****ZDI-22-1494
ZDI-CAN-16142
CVE ID
CVE-2022-43620
CVSS SCORE
8.8, (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
AFFECTED VENDORS
D-Link
AFFECTED PRODUCTS
DIR-1935
VULNERABILITY DETAILS
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system.
ADDITIONAL DETAILS
D-Link has issued an update to correct this vulnerability. More details can be found at:
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
DISCLOSURE TIMELINE
- 2022-06-17 - Vulnerability reported to vendor
- 2022-11-03 - Coordinated public release of advisory
CREDIT
Anonymous
BACK TO ADVISORIES