CVE-2020-26567

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed without authentication. Any access reboots the device, rendering it therefore unusable for several minutes.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/159516/D-Link-DSR-250N-Denial-Of-Service.htmlExploit, Mitigation, Patch, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Oct/14Exploit, Mailing List, Mitigation, Patch, Third Party Advisory
https://www.redteam-pentesting.de/advisories/rt-sa-2020-002Exploit, Mitigation, Patch, Third Party Advisory
http://packetstormsecurity.com/files/159516/D-Link-DSR-250N-Denial-Of-Service.htmlExploit, Mitigation, Patch, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Oct/14Exploit, Mailing List, Mitigation, Patch, Third Party Advisory
https://www.redteam-pentesting.de/advisories/rt-sa-2020-002Exploit, Mitigation, Patch, Third Party Advisory

Timeline

Published: Oct 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-265695.9In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incor CVE-2020-26574.7Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that ar CVE-2020-265705.5The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.CVE-2020-265715.5The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.CVE-2020-265725.5The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.CVE-2020-265749.6Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webque CVE-2020-265757.5In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was addressed in epan/disse CVE-2020-26588.2Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Supported versions that are affected are 12.1.1 CVE-2020-265828.8D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON CVE-2020-265836.1An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. It allows unauthenticated users to upload JavaScript (in a file) via the e CVE-2020-265846.1An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. The search field "Kurs suchen" on the page Kurskatalog is vulnerable to Re CVE-2020-26593.7Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are J