CVE-2020-9276

An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The function do_cgi(), which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with CVE-2020-9277.

• CWE-787

• https://raelize.com/advisories/CVE-2020-9276_D-Link-DSL-2640B_do_cgi-buffer-overflow_v1.0.txtThird Party Advisory
• https://raelize.com/posts/d-link-dsl-2640b-security-advisories/Exploit, Third Party Advisory
• https://www.dlink.com/en/security-bulletinVendor Advisory
• https://raelize.com/advisories/CVE-2020-9276_D-Link-DSL-2640B_do_cgi-buffer-overflow_v1.0.txtThird Party Advisory
• https://raelize.com/posts/d-link-dsl-2640b-security-advisories/Exploit, Third Party Advisory
• https://www.dlink.com/en/security-bulletinVendor Advisory

Published

Apr 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9270ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password …8.8
• CVE-2020-9271ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user crea…6.5
• CVE-2020-9272ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability …7.5
• CVE-2020-9273In ProFTPD 1.3.7, it is possible to corrupt the memory pool …8.8
• CVE-2020-9274An issue was discovered in Pure-FTPd 1.0.49. An uninitialize…7.5
• CVE-2020-9275An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.8
• CVE-2020-9277An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.8
• CVE-2020-9278An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.1
• CVE-2020-9279An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.8
• CVE-2020-9280In SilverStripe through 4.5, files uploaded via Forms to fol…7.5
• CVE-2020-9281A cross-site scripting (XSS) vulnerability in the HTML Data …6.1
• CVE-2020-9282In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19…6.5