CVE-2020-25757

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Dec 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-257588.8An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authen CVE-2020-257598.8An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an au CVE-2020-25766.5Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version CVE-2020-257608.8Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input validation on the 'rid' p CVE-2020-257616.1Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request paramete CVE-2020-257629.1An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the use CVE-2020-257639.8Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code CVE-2020-257659.8Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Dev CVE-2020-257667.5An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked t CVE-2020-257677.5An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnc_copy_in routine for parsing DNS domain names does not check whether a d CVE-2020-257685.3Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in f CVE-2020-25774.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.28 and prior and