9

CVE-2020-25758

An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to inject arbitrary crontab entries into saved configurations before uploading. These entries are executed as root.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dlink ≫ Dsr-150 Firmware Version <= 3.17
   Dlink ≫ Dsr-150 Version-
Dlink ≫ Dsr-150n Firmware Version <= 3.17
   Dlink ≫ Dsr-150n Version-
Dlink ≫ Dsr-250 Firmware Version <= 3.17
   Dlink ≫ Dsr-250 Version-
Dlink ≫ Dsr-250n Firmware Version <= 3.17
   Dlink ≫ Dsr-250n Version-
Dlink ≫ Dsr-500 Firmware Version <= 3.17
   Dlink ≫ Dsr-500 Version-
Dlink ≫ Dsr-500n Firmware
   Dlink ≫ Dsr-500n Version-
Dlink ≫ Dsr-500ac Firmware Version <= 3.17
   Dlink ≫ Dsr-500ac Version-
Dlink ≫ Dsr-1000 Firmware Version <= 3.17
   Dlink ≫ Dsr-1000 Version-
Dlink ≫ Dsr-1000n Firmware Version <= 3.17
   Dlink ≫ Dsr-1000n Version-
Dlink ≫ Dsr-1000ac Firmware Version <= 3.17
   Dlink ≫ Dsr-1000ac Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.537
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-354 Improper Validation of Integrity Check Value

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.