CVE-2020-12774

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
D-LinkDSL-7740C<= DSL7740C.V6.TR069.20180723

References

Timeline

Published
Jul 22, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-127759.8Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthentCVE-2020-127767.2Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain thCVE-2020-127777.5A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclCVE-2020-127786.1Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.CVE-2020-127795.4Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.CVE-2020-12787.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'CVE-2020-127807.5A security misconfiguration exists in Combodo iTop, which can expose sensitive information.CVE-2020-127818.8Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request CVE-2020-127829.8Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment willCVE-2020-127837.5Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and CVE-2020-127845.3cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).CVE-2020-127858.1cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).
CVE-2020-12774: Medium severity, CVSS 6.7 | Vulnix