CVE-2018-20432

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-09-14 · updated 2026-06-17
Weakness: CWE-798

Description

D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use hardcoded credentials for telnet connection, which allows unauthenticated attackers to gain privileged access to the router, and to extract sensitive data or modify the configuration.

Affected products

Dlink Covr-2600R Firmware: through 1.01b05
Dlink Covr-3902 Firmware: through 1.01b05

References

http://packetstormsecurity.com/files/159058/COVR-3902-1.01B0-Hardcoded-Credentials.html
https://cybersecurityworks.com/zerodays/cve-2018-20432-dlink.html
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10109
http://packetstormsecurity.com/files/159058/COVR-3902-1.01B0-Hardcoded-Credentials.html
https://cybersecurityworks.com/zerodays/cve-2018-20432-dlink.html
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10109

Get alerted when CVE-2018-20432 or the next vulnerability affects your stack