CVE-2020-15894 Missing authorization in n/a
An exposed administration function in D-Link DIR-816L routers allows attackers to retrieve sensitive admin credentials without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15894?
CVE-2020-15894 is a high-severity missing authorization vulnerability in n/a, published on 22 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT.
Weakness: CWE-306
Which versions are affected by CVE-2020-15894?
It affects 1 product.
Products include Dlink Dir-816l Firmware.
How do I fix CVE-2020-15894?
No fix has been published for CVE-2020-15894 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-15894 being exploited?
There is no known exploitation of CVE-2020-15894 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-28956 Auth bypass in n/a
- CVE-2020-15893 Command injection in n/a
- CVE-2025-13188 D-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflow
- CVE-2025-13189 D-Link DIR-816L gena.cgi genacgi_main stack-based overflow
- CVE-2025-13190 D-Link DIR-816L __ajax_exporer.sgi scandir_main stack-based overflow
Sources
Also known as GHSA-4xhc-v448-j5jx.