CVE-2020-25758

Published: Dec 15, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to inject arbitrary crontab entries into saved configurations before uploading. These entries are executed as root.

Affected (10)

Products: Dlink: Dsr 150 Firmware, Dsr 150n Firmware, Dsr 250 Firmware, Dsr 250n Firmware, Dsr 500 Firmware, Dsr 500n Firmware, Dsr 500ac Firmware, Dsr 1000 Firmware, Dsr 1000n Firmware, Dsr 1000ac Firmware

10 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 150 Firmware	Up to 3.17

Running on/with	Platform Versions
Dlink Dsr 150	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 150n Firmware	Up to 3.17

Running on/with	Platform Versions
Dlink Dsr 150n	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 250 Firmware	Up to 3.17

Running on/with	Platform Versions
Dlink Dsr 250	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 250n Firmware	Up to 3.17

Running on/with	Platform Versions
Dlink Dsr 250n	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 500 Firmware	Up to 3.17

Running on/with	Platform Versions
Dlink Dsr 500	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 500n Firmware	All versions

Running on/with	Platform Versions
Dlink Dsr 500n	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 500ac Firmware	Up to 3.17

Running on/with	Platform Versions
Dlink Dsr 500ac	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 1000 Firmware	Up to 3.17

Running on/with	Platform Versions
Dlink Dsr 1000	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 1000n Firmware	Up to 3.17

Running on/with	Platform Versions
Dlink Dsr 1000n	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dlink Dsr 1000ac Firmware	Up to 3.17

Running on/with	Platform Versions
Dlink Dsr 1000ac	All versions

Related CWEs

CWE-354

Improper Validation of Integrity Check Value

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

References (6)

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195

Source: cve@mitre.org

Vendor Advisory

https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/

Source: cve@mitre.org

Third Party Advisory

https://www.dlink.com/en/security-bulletin

Source: cve@mitre.org

Vendor Advisory

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.dlink.com/en/security-bulletin

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.