CVE-2020-8863: D-Link DIR router HNAP authentication bypass allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network-adjacent code execution on internet-edge routers with a very high EPSS score, though not yet in KEV and requiring adjacency rather than remote internet access.

What it is

D-Link DIR-867, DIR-878 and DIR-882 routers running firmware 1.10B04 mishandle HNAP login requests, failing to properly implement the authentication algorithm. A network-adjacent attacker can bypass authentication without credentials and then escalate privileges to execute code as the router. This exposes the router's management plane to anyone on the adjacent network segment.

Impact

An attacker gains authenticated-equivalent access to the router and can execute code in its context, taking full control of the device. That enables traffic interception, configuration changes and use of the router as a foothold into the local network.

Attack surface

Reached over the network from an adjacent segment (AV:A) via HNAP login requests; no authentication (PR:N) and no user interaction (UI:N) are required. The flaw is in the router's HNAP request handling, so any reachable management interface on the affected firmware is exposed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.767, 99.5th percentile), indicating strong likelihood of attempted exploitation. References are only vendor and ZDI advisories, with no public exploit tag in the record.

What to do

• Apply the D-Link firmware update referenced in advisory SAP10157 for DIR-867, DIR-878 and DIR-882; if no fixed firmware exists for a model, replace or retire it.
• Disable or block remote/adjacent access to the router's HNAP and web management interface; restrict administration to a trusted wired segment.
• Segment IoT and router management traffic so untrusted clients cannot reach the management plane.
• Monitor D-Link advisories and replace end-of-support models that will not receive fixes.

Detection

• Alert on HNAP login requests to affected routers from unexpected or non-administrative source addresses.
• Monitor router logs and syslog for authentication bypass patterns, repeated HNAP login attempts, or configuration changes outside maintenance windows.
• Watch for unexpected outbound connections or DNS changes originating from the router itself.
• Baseline normal management traffic and flag new hosts reaching the router's HNAP endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.