CVE-2020-15894

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT.

• CWE-306

• https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/Third Party Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169Patch, Vendor Advisory
• https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/Third Party Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169Patch, Vendor Advisory

Published

Jul 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15888Lua through 5.4.0 mishandles the interaction between stack r…8.8
• CVE-2020-15889Lua 5.4.0 has a getobjname heap-based buffer over-read becau…9.8
• CVE-2020-1589<p>An information disclosure vulnerability exists when the W…4.4
• CVE-2020-15890LuaJit through 2.1.0-beta3 has an out-of-bounds read because…7.5
• CVE-2020-15892An issue was discovered in apply.cgi on D-Link DAP-1520 devi…9.8
• CVE-2020-15893An issue was discovered on D-Link DIR-816L devices 2.x befor…9.8
• CVE-2020-15895An XSS issue was discovered on D-Link DIR-816L devices 2.x b…6.1
• CVE-2020-15896An authentication-bypass issue was discovered on D-Link DAP-…7.5
• CVE-2020-15897Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x be…7.5
• CVE-2020-15898In Arista EOS malformed packets can be incorrectly forwarded…5.3
• CVE-2020-15899Grin 3.0.0 before 4.0.0 has insufficient validation of data …7.5
• CVE-2020-1590<p>An elevation of privilege vulnerability exists when the C…6.6