CVE-2020-24577

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI.

• CWE-312

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/Exploit, Third Party Advisory
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/Third Party Advisory
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241Exploit, Third Party Advisory
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/Exploit, Third Party Advisory
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/Third Party Advisory
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241Exploit, Third Party Advisory

Published

Jan 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24570An issue was discovered in MB CONNECT LINE mymbCONNECT24 and…6.5
• CVE-2020-24571NexusQA NexusDB before 4.50.23 allows the reading of files v…7.5
• CVE-2020-24572An issue was discovered in includes/webconsole.php in RaspAP…8.8
• CVE-2020-24573BAB TECHNOLOGIE GmbH eibPort V3 prior to 3.8.3 devices allow…7.5
• CVE-2020-24574The client (aka GalaxyClientService.exe) in GOG GALAXY throu…7.8
• CVE-2020-24576Netskope Client through 77 allows low-privileged users to el…8.8
• CVE-2020-24578An issue was discovered on D-Link DSL-2888A devices with fir…6.5
• CVE-2020-24579An issue was discovered on D-Link DSL-2888A devices with fir…8.8
• CVE-2020-24580An issue was discovered on D-Link DSL-2888A devices with fir…7.5
• CVE-2020-24581An issue was discovered on D-Link DSL-2888A devices with fir…8
• CVE-2020-24582Zulip Desktop before 5.4.3 allows XSS because string escapin…6.1
• CVE-2020-24583An issue was discovered in Django 2.2 before 2.2.16, 3.0 bef…7.5