CVE-2020-24577: dlink dsl-2888a_firmware
Vulnerability summary
CVE-2020-24577 is a high (CVSS 7.5) vulnerability in dlink dsl-2888a_firmware. EPSS estimates a 19.06% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 08-01-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
19.06%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 19.06% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (trustwave.com)
Maturity: unknown
Exploit Reference (trustwave.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Dlink1 product
- dsl-2888a_firmware< au_2.31_v1.1.47ae55
1 vendor · 1 product
References
3 links- www.trustwave.com/en-us/resources/security-resources/security-advisories/X Refsource CONFIRMThird Party Advisory
- www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241X Refsource MISCExploitThird Party Advisory