CVE-2020-15892

An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length of 15 characters. The problem is that validation is being done on the client side, hence it can be bypassed. When an attacker manages to intercept the login request (POST based) and tampers with the vulnerable parameter (log_pass), to a larger length, the request will be forwarded to the webserver. This results in a stack-based buffer overflow. A few other POST variables, (transferred as part of the login request) are also vulnerable: html_response_page and log_user.

• CWE-669
• CWE-787

• https://research.loginsoft.com/bugs/classic-stack-based-buffer-overflow-in-dlink-firmware-dap-1520/Exploit, Third Party Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169Patch, Vendor Advisory
• https://research.loginsoft.com/bugs/classic-stack-based-buffer-overflow-in-dlink-firmware-dap-1520/Exploit, Third Party Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169Patch, Vendor Advisory

Published

Jul 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15886A SQL injection vulnerability in reportdata_controller.php i…8.8
• CVE-2020-15887A SQL injection vulnerability in softwareupdate_controller.p…8.8
• CVE-2020-15888Lua through 5.4.0 mishandles the interaction between stack r…8.8
• CVE-2020-15889Lua 5.4.0 has a getobjname heap-based buffer over-read becau…9.8
• CVE-2020-1589<p>An information disclosure vulnerability exists when the W…4.4
• CVE-2020-15890LuaJit through 2.1.0-beta3 has an out-of-bounds read because…7.5
• CVE-2020-15893An issue was discovered on D-Link DIR-816L devices 2.x befor…9.8
• CVE-2020-15894An issue was discovered on D-Link DIR-816L devices 2.x befor…7.5
• CVE-2020-15895An XSS issue was discovered on D-Link DIR-816L devices 2.x b…6.1
• CVE-2020-15896An authentication-bypass issue was discovered on D-Link DAP-…7.5
• CVE-2020-15897Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x be…7.5
• CVE-2020-15898In Arista EOS malformed packets can be incorrectly forwarded…5.3