{"vulnerability": "CVE-2020-2955", "sightings": [{"uuid": "f4dd09b1-5922-46ad-9e84-2bb8bef50097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:17.000000Z"}, {"uuid": "b622a038-04b7-414f-ab81-b1262e70f920", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "1290a347-15d3-4bc1-a34a-4d061e21931a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29552", "type": "seen", "source": "MISP/6a079369-d681-4501-8900-e3e90a37e1ae", "content": "", "creation_timestamp": "2024-11-14T06:07:40.000000Z"}, {"uuid": "6f401e10-dfac-4dc2-b702-97693e20909a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29551", "type": "seen", "source": "MISP/db848b0a-32f8-4b0e-b6a9-4b8a52810c58", "content": "", "creation_timestamp": "2024-11-14T06:07:41.000000Z"}, {"uuid": "a9aae2f9-0f05-4ba8-bbb2-348c5fae50fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29550", "type": "seen", "source": "MISP/f9094c19-eec5-49b6-9e8e-17ab22c5ab67", "content": "", "creation_timestamp": "2024-11-14T06:07:41.000000Z"}, {"uuid": "c727bf3b-546d-4e8f-8b46-517638f5d014", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971100", "content": "", "creation_timestamp": "2024-12-24T20:24:15.939926Z"}, {"uuid": "b3ccde93-8fd9-4045-b20c-45e3a912811c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-27)", "content": "", "creation_timestamp": "2025-01-27T00:00:00.000000Z"}, {"uuid": "112fa7bc-7880-4fa4-a85e-172aa45ae27e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-01-27)", "content": "", "creation_timestamp": "2025-01-27T00:00:00.000000Z"}, {"uuid": "87e70db5-724f-47d0-ae49-634b76d2a2c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:47.000000Z"}, {"uuid": "866eba71-8983-4577-89e4-dae7c1382689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-29557", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2e28cb83-3eb5-4683-bcd6-dc5dda244291", "content": "", "creation_timestamp": "2026-02-02T12:28:42.397760Z"}, {"uuid": "7e71803f-75a7-4e6e-84a5-8f85917ec1f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29553", "type": "seen", "source": "https://t.me/arpsyndicate/4871", "content": "#ExploitObserverAlert\n\nCVE-2020-29553\n\nDESCRIPTION: Exploit Observer has 10 entries in 3 file formats related to CVE-2020-29553. The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).\n\nFIRST-EPSS: 0.001050000\nNVD-IS: 5.9\nNVD-ES: 2.8\nARPS-PRIORITY: 0.7616317", "creation_timestamp": "2024-04-25T21:38:04.000000Z"}, {"uuid": "ec162928-0569-40da-a017-266f30f9a9a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29555", "type": "seen", "source": "https://t.me/arpsyndicate/4869", "content": "#ExploitObserverAlert\n\nCVE-2020-29555\n\nDESCRIPTION: Exploit Observer has 10 entries in 3 file formats related to CVE-2020-29555. The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)\n\nFIRST-EPSS: 0.000810000\nNVD-IS: 5.2\nNVD-ES: 2.8\nARPS-PRIORITY: 0.7616317", "creation_timestamp": "2024-04-25T21:30:55.000000Z"}, {"uuid": "736494c0-4795-4e44-857a-ee9b895ca83c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "seen", "source": "https://t.me/arpsyndicate/2157", "content": "#ExploitObserverAlert\n\nCVE-2020-29557\n\nDESCRIPTION: Exploit Observer has 2 entries related to CVE-2020-29557. An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.\n\nFIRST-EPSS: 0.037730000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-12-24T07:05:52.000000Z"}, {"uuid": "262d1f34-bbdf-4b14-8d4a-b969e3b3c156", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "seen", "source": "https://t.me/cibsecurity/22855", "content": "\u203c CVE-2020-29557 \u203c\n\nAn issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-29T23:25:09.000000Z"}, {"uuid": "ab8057ea-179f-4064-895f-53ebd3881e1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29552", "type": "seen", "source": "https://t.me/cibsecurity/21234", "content": "\u203c CVE-2020-29552 \u203c\n\nAn issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+\" substring, it is possible to execute a Powershell command and redirect its output to a file under the web root.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-23T19:25:33.000000Z"}, {"uuid": "a877db0e-add8-4e0a-a15b-f0c851c83058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29551", "type": "seen", "source": "https://t.me/cibsecurity/21231", "content": "\u203c CVE-2020-29551 \u203c\n\nAn issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown the system. Among others, the following files and scripts are also accessible: _internal/pc/abort.php, _internal/pc/restart.php, _internal/pc/vpro.php, _internal/pc/wake.php, _internal/error_u201409.txt, _internal/runcmd.php, _internal/getConfiguration.php, ews/autoload.php, ews/del.php, ews/mod.php, ews/sync.php, utils/backup/backup_server.php, utils/backup/restore_server.php, MyScreens/timeline.config, kreator.html5/test.php, and addedlogs.txt.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-23T19:25:30.000000Z"}, {"uuid": "1a57fe41-6501-4018-affd-63010829f0bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29550", "type": "seen", "source": "https://t.me/cibsecurity/21226", "content": "\u203c CVE-2020-29550 \u203c\n\nAn issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service) is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext: Profiles/urve/files/sql_db.backup, Server/data/pg_wal/000000010000000A000000DD, Server/data/base/16384/18617, and Server/data/base/17202/8708746. This causes the password to be displayed as cleartext in the HTML code as roomsreservationimport_password in /urve/roomsreservationimport/roomsreservationimport/update-HTML5.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-23T19:25:22.000000Z"}, {"uuid": "6023b317-640c-4839-99e8-6977087c269f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5f0ad467-94bf-4604-b7b1-ada551544dc9", "content": "", "creation_timestamp": "2026-06-19T12:47:58.738339Z"}, {"uuid": "7cac4956-7010-427f-b3d5-25f40fe4f08f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7275e5d2-e879-4605-a493-6a5096cf8478", "content": "", "creation_timestamp": "2026-06-23T14:04:44.668864Z"}, {"uuid": "a433fa9d-09cb-4bbd-bd81-7fa85683bdc6", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-29557", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6e3a2bd6-f233-496f-a68f-3a097bc739c7", "content": "", "creation_timestamp": "2026-06-30T10:21:47.279986Z"}, {"uuid": "d5a4b30e-7644-4904-a23b-d50158d183fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29557", "type": "seen", "source": "https://t.me/hacking_Attack/19651", "content": "be very successful, cheap and easy to carry out.\u201d\nSee Also: Offensive Security Tool: Mimikatz In addition to the router bug, Juniper researchers observed the following known vulnerabilities being exploited to gain initial access to target devices:\n\n* CVE-2020-29557 (DLink routers)\n* CVE-2021-1497 and CVE-2021-1498 (Cisco HyperFlex)\n* CVE-2021-31755 (Tenda AC11)\n* CVE-2021-22502 (MicroFocus OBR)\n* CVE-2021-22506 (MicroFocus AM)\n\nIn fact, the attackers have been continuously adding new exploits to its arsenal, according to the posting, and CVE-2021-20090 is unlikely to be the last.\n\n\u201cIt is clear that threat actors keep an eye on all disclosed vulnerabilities,\u201d researchers concluded. \u201cWhenever an exploit PoC is published, it often takes them very little time to integrate it into their platform and launch attacks.\u201d\n\nTo avoid compromise, users should update their firmware on the router. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker \u201cIn the case of IoT devices or home gateways, the situation is much worse as most users are not tech-savvy and even those who are do not get informed about potential vulnerabilities and patches to apply,\u201d according to Juniper. \u201cThe only sure way to remedy this issue is to require vendors to offer zero-down-time automatic updates.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080885-90x90.jpg MacOS Flaw in Telegram Retrieves Deleted Messages4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/spam-call-90x90.jpg Black Hat: \u2018I\u2019m Calling About Your Car Warranty\u2019, aka PII Hijinx5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Google-Chrome-Browser-Management-90x90.png Bugs in Chrome\u2019s JavaScript engine can lead to powerful exploits. This project aims to stop them6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/chinese-flag-keyboard-internet-istock-90x90.jpg DeadRinger: Chinese APTs strike major telecommunications companies1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/public-wifi-90x90.jpg NSA Warns Public Networks are Hacker Hotbeds1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/iran-thumb-90x90.jpg Hackers used never-before-seen wiper in recent attack on Iranian train system2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/PunkSpider-90x90.png Reboot of PunkSpider Tool at DEF CON Stirs Debate2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/apple-mac-security-90x90.jpg Apple Patches Actively Exploited Zero-Day in iOS, MacOS2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Windows-Abstract-90x90.jpg Microsoft Rushes Fix for \u2018PetitPotam\u2019 Attack PoC2 weeks ago\nstyle=\"display:block; text-align:center;\"\n data-ad-layout=\"in-article\"\n data-ad-format=\"fluid\"\n data-ad-client=\"ca-pub-6620833063853657\"\n data-ad-slot=\"4517761481\"> \nThe post Auth Bypass Bug Exploited, Affecting Millions of Routers first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:29.752166Z"}]}