Insufficiently protected credentials in D-Link Router DIR-880L
Priority LOW 36CWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522 and CWE-798.
Summary
The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data.
Why it matters now
EPSS 0.01711 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | D-Link Router DIR-880L | 1.07 | — | No fix listed | CNA |
- D-Link Router DIR-880L Vendor— Affected 1.07 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dlink:dir-880l_firmware:1.07:*:*:*:*:*:*:* | 1.07 | Vulnerable | D-Link Japan K.K. |
| cpe:2.3:h:dlink:dir-880l:-:*:*:*:*:*:*:* | not specified by NVD | Running on | D-Link Japan K.K. |
- cpe:2.3:o:dlink:dir-880l_firmware:1.07:*:*:*:*:*:*:* Versions 1.07 Vulnerable ·D-Link Japan K.K.
- cpe:2.3:h:dlink:dir-880l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-29322
- 2026-10-03 Alias added: GHSA-9v84-5wgx-22rg
References
More D-Link Japan K.K. Dir-880l Firmware vulnerabilities
- TI-2019-13149 The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-04810 OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-05627 D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login action CVSS 3.0CRITICAL 9.8
- TI-2025-03870 D-Link DIR-880L Request Header ssdpcgi sub_16570 command injection CVSS 4.0MEDIUM 5.3
- TI-2017-10971 Certain D-Link products are affected by: Buffer Overflow. CVSS 3.1CRITICAL 9.8
- TI-2018-14680 D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A*… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-29322 · CVE Program
- CVE-2020-29322 · NVD
- FIRST EPSS
- GHSA-9v84-5wgx-22rg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences