Cyber Resilience

CVE-2020-8863

Auth Bypass in Dlink Dir-878 Firmware ≤ 1.20b03

High EPSSAuth Bypass
Published
23 March 2020
Modified
21 November 2024
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.77 99.5th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2020-8863 is a high-severity Incorrect Implementation of Authentication Algorithm (CWE-303) vulnerability in Dlink Dir-878 Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests.…

more

The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-9470.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability allows unauthenticated network-adjacent attackers to bypass authentication on a public-facing router via flawed HNAP login handling.
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Successful exploitation grants the attacker elevated privileges on the router, enabling privilege escalation.
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Privilege escalation on the router facilitates arbitrary command execution in the router's context.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-8864Same product: Dlink Dir-867
CVE-2024-48630Same product: Dlink Dir-878
CVE-2024-48633Same product: Dlink Dir-878
CVE-2024-48635Same product: Dlink Dir-878
CVE-2024-48636Same product: Dlink Dir-878
CVE-2024-48637Same product: Dlink Dir-878
CVE-2024-48629Same product: Dlink Dir-878
CVE-2024-48632Same product: Dlink Dir-878
CVE-2024-48634Same product: Dlink Dir-878
CVE-2024-48631Same product: Dlink Dir-878

Affected Assets

dlink
dir-878 firmware
≤ 1.20b03
dlink
dir-882 firmware
≤ 1.10b04
dlink
dir-867 firmware
≤ 1.10b04

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 5 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.4
  • V6.5.4
  • V6.5.5
  • V6.5.7

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-287

Detects unauthorized successful logons resulting from improper authentication implementations.

addresses: CWE-287

Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.

addresses: CWE-287

Security awareness training instructs users on secure authentication practices and avoiding credential compromise.

addresses: CWE-287

Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.

addresses: CWE-287

Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.

addresses: CWE-287

Session content review can reveal authentication bypasses or failures in session establishment.

addresses: CWE-287

Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.

addresses: CWE-287

Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

PR.AA-03 directly enforces authentication mechanisms that eliminate most improper-authentication defects, yet CWE-287 spans additional vectors (missing checks, flawed protocols, session handling) that one control does not fully close.

PR.AA-04 mostly match
prevents

PR.AA-04 directly enables verification of identity assertions (mostly preventing CWE-287 in that scope) yet leaves many other authentication failure modes unaddressed (only partial prevention overall).

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require correct implementation of authentication algorithms.

PR.AA-01 partial match
prevents

PR.AA-01 supplies and governs credentials/tokens that authentication relies on, removing some weak-credential cases, yet leaves verification logic, missing checks, and protocol flaws untouched.

PR.AA-02 partial match
prevents

PR.AA-02 ensures valid enrollment and unique credential binding, which reduces some improper-auth risks at issuance time but leaves runtime claim verification untouched, so each direction only partially addresses the other.

PR.PS-01 partial match
prevents

PR.PS-01 can enforce auth-related settings via hardened baselines and default reviews, blocking some config-based instances of CWE-287, yet leaves code-level auth flaws untouched so neither direction reaches mostly.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Secure authentication control directly requires correct implementation of authentication algorithms.

prevents

Verifying user identity before issuing replacement credentials and forcing changes after compromise reduces the likelihood that authentication bypass can be achieved through stolen or weak credentials.

detects

Security testing can detect flawed authentication implementations but does not prevent them by itself.

prevents

Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.

mitigates

Requiring authentication mechanisms and technical parameters for secure connections ensures that network services verify user identity before granting access, preventing exploitation of missing or weak authentication.

degrades

Cryptography control addresses proper use of authentication algorithms but is broader than authentication alone.

References