CVE-2020-29557 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03
D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface. This flaw allows a remote, unauthenticated attacker to achieve code execution on the device.
Yes. CVE-2020-29557 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2020-29557?
Critical severity, with a CVSS score of 9.8, published 3 November 2021.
Which products and versions are affected?
D-Link DIR-825 R1 Firmware through 3.0.1 before 2020-11-20; D-Link DIR-825 R1; D-Link DIR-825/A D1A; D-Link DIR-825/AC E1A; and 3 more.
Is there a fix for CVE-2020-29557?
A patch was published on 2020-11-20: Firmware versions before this date are vulnerable. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-29557 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2020-29557?
Check whether you run D-Link Dir-825 R1 Devices. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
D-Link DIR-825 R1 Firmware through 3.0.1 before 2020-11-20
D-Link DIR-825 R1
D-Link DIR-825/A D1A
D-Link DIR-825/AC E1A
D-Link DIR-825/AC E
D-Link DIR-825/ACF F1
D-Link DIR-825/GF GF
Timeline
2020-11-20: patched: Firmware versions before this date are vulnerable.
2021-11-03: disclosed
2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
2021-11-03: exploited: Reported as exploited in the wild.