CVE-2022-37123: Improper Neutralization of Special Elements used in an OS Command

D-link DIR-816 A2v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi...

CVE-2021-39510: Improper Neutralization of Special Elements used in a Command

An issue was discovered in D-Link DIR816A1FW101CNB04 750m11ac wireless router, The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell...

PT-2021-22599

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 version DIR-816A2 FWv1.10CNB05 R1B011D88210 Description: An issue was discovered where the HTTP request parameter is used in the handler function of the "/goform/form2userconfig.cgi" route. This allows constructing the user nam...

CVE-2021-39509: Improper Neutralization of Special Elements used in a Command

An issue was discovered in D-Link DIR-816 DIR-816A2FWv1.10CNB05R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell...

PT-2021-22600

Name of the Vulnerable Software and Affected Versions: D-Link DIR816 A1 FW101CNB04 Description: An issue was discovered in the D-Link DIR816 A1 FW101CNB04 750m11ac wireless router. The HTTP request parameter is used in the handler function of "/goform/form2userconfig.cgi" route, which can constru...

PT-2019-11393

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.11 Description: The issue allows an attacker to edit the system account without authentication by exploiting the fact that the router only checks the random token when authorizing a goform request. The token can be...

CVE-2019-10041: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication...

CVE-2018-20305: Out-of-bounds Write

D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address...