CVE-2020-15894

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-158956.1An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is app CVE-2020-158967.5An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directl CVE-2020-158977.5Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic CVE-2020-158985.3In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible CVE-2020-158997.5Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.CVE-2020-15906.6<p>An elevation of privilege vulnerability exists when the Connected User Experiences and Telemetry Service improperly handles file operatio CVE-2020-159009.8A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of CVE-2020-159018.8In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.CVE-2020-159026.1Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.CVE-2020-159039.8An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some i CVE-2020-159047.8A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a CVE-2020-159069.8tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.