D-Link DI-624/NetworkEverywhere NR041 crossite scripting

Information from DFHCP request is shown on web administration page without filtering...

DLINK 624, script injection vulnerability

TITLE: Security flaw in DLINK 624 - SOHO routers http://www.dlink.com TYPE: Script injection over DHCP QUOTE from DLINK: The D-Link Xtreme G DI-624 wireless router with 108Mbps^ upgrade employs five cutting-edge hardware-based compression technologies to achieve a significant boost in performance...

CVE-2004-0615

CVE-2004-0615 describes a cross-site scripting (XSS) vulnerability in D-Link DI-614+ (firmware 2.30), DI-704 (firmware 2.60B2), and DI-624 routers, exploitable by injecting arbitrary script/HTML via the DHCP HOSTNAME option in a DHCP request. Connected PT-2004-1707 details confirm the affected mo...