Vulnerability record · CVE-2020-8864 · published 23 March 2020
CVE-2020-8864: D-Link DIR router HNAP authentication bypass via empty password
Dlink · Dir 878 Firmware
D-Link DIR-867, DIR-878 and DIR-882 routers running firmware 1.10B04 mishandle empty passwords in HNAP login requests, allowing authentication to be bypassed. Because the flaw is reachable by network-adjacent attackers without credentials, it exposes the router's management interface to unauthenticated compromise.
Description
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9471.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityUnauthenticated network-adjacent code execution on widely deployed consumer routers with very high EPSS, though not confirmed in KEV or with public exploit tags.
What it is
D-Link DIR-867, DIR-878 and DIR-882 routers running firmware 1.10B04 mishandle empty passwords in HNAP login requests, allowing authentication to be bypassed. Because the flaw is reachable by network-adjacent attackers without credentials, it exposes the router's management interface to unauthenticated compromise.
Impact
An attacker gains unauthenticated access to the router and can execute arbitrary code on it, taking full control of the device and any traffic or credentials it handles.
Attack surface
Reached over the network from an adjacent position (AV:A) via HNAP login requests; no authentication (PR:N) and no user interaction (UI:N) are required.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high at 0.802 (99.6th percentile), indicating strong predicted exploitation activity.
What to do
- Apply the D-Link vendor advisory SAP10157 firmware update for DIR-867, DIR-878 and DIR-882 as the first action.
- If firmware cannot be updated, disable remote management and restrict HNAP/management access to trusted LAN segments only.
- Segment or isolate these routers from sensitive networks and treat them as untrusted edge devices.
- Replace end-of-support units that no longer receive firmware fixes.
- Monitor vendor advisories for follow-up patches covering the same HNAP handling flaw.
Detection
- Alert on HNAP login requests containing empty or missing password fields.
- Monitor for unexpected HNAP requests originating from adjacent hosts rather than the admin workstation.
- Watch for new or anomalous processes, outbound connections, or configuration changes on the routers.
- Baseline normal HNAP traffic and flag deviations in request rate or source.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-20-268/ | Third Party AdvisoryVDB Entry |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-20-268/ | Third Party AdvisoryVDB Entry |
Track CVE-2020-8864 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-8864), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
