CVE-2023-35726

The CVE-2023-35726 issue affects D-Link DAP-2622 routers, originating in the DDP service. It is a stack-based buffer overflow caused by insufficient validation of user-supplied data length before copying to a fixed-size stack buffer. This allows network-adjacent attackers to execute arbitrary cod...

CVE-2023-35726 D-Link DAP-2622 DDP User Verification Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP User Verification Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-35725

CVE-2023-35725 affects D-Link DAP-2622 devices via a stack-based buffer overflow in the DDP service. The vulnerability arises from improper validation of user-supplied data length before copying to a fixed-length stack buffer, enabling network-adjacent attackers to execute code with root privileg...

CVE-2023-35725 D-Link DAP-2622 DDP User Verification Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP User Verification Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-35724

The CVE-2023-35724 entry concerns D-Link DAP-2622 routers where the Telnet CLI service uses hard-coded credentials, allowing authentication bypass for network-adjacent attackers. Affected component: Telnet/CLI service listening on TCP port 23. Root cause: server program contains hard-coded creden...

CVE-2023-35724 D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability

D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specif...

CVE-2023-35723

The CVE-2023-35723 entry concerns a D-Link DIR-X3260 router vulnerability in the prog.cgi SOAPAction handler. The flaw arises from insufficient validation of a user-supplied string in the SOAPAction header before it is used to execute a system call, enabling a command injection that can execute c...

CVE-2023-35722

CVE-2023-35722 affects NETGEAR RAX30 routers. The flaw is in UPnP port-mapping request handling where unvalidated user input is used to execute a system call, enabling remote code execution with root privileges. Exploitation is possible without authentication and occurs from a network-adjacent po...

CVE-2023-35721 NETGEAR Multiple Routers curl_post Improper Certificate Validation Remote Code Execution Vulnerability

NETGEAR Multiple Routers curlpost Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of multiple NETGEAR routers. Authentication is not required t...

CVE-2023-35720

CVE-2023-35720 affects ASUS RT-AX92U via the mod_webdav.so module. The flaw allows network-adjacent attackers to disclose sensitive information through SQL injection in requests, with no authentication required and root context obtainable. The vulnerability stems from inadequate validation of a u...

CVE-2023-35720 ASUS RT-AX92U lighttpd mod_webdav.so SQL Injection Information Disclosure Vulnerability

ASUS RT-AX92U lighttpd modwebdav.so SQL Injection Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected ASUS RT-AX92U routers. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2023-35720 ASUS RT-AX92U lighttpd mod_webdav.so SQL Injection Information Disclosure Vulnerability

ASUS RT-AX92U lighttpd modwebdav.so SQL Injection Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected ASUS RT-AX92U routers. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2023-35718 D-Link DAP-2622 DDP Change ID Password Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP Change ID Password Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-35718 D-Link DAP-2622 DDP Change ID Password Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP Change ID Password Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-35717 TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability

TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link Tapo C210 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2023-35717

CVE-2023-35717 concerns the TP-Link Tapo C210 IP cameras, where the password recovery mechanism enables authentication bypass. The flaw stems from relying on the secrecy of the password derivation algorithm to generate a recovery password, allowing network-adjacent attackers to bypass authenticat...

CVE-2023-35717 TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability

TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link Tapo C210 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2023-35715

CVE-2023-35715 affects Ashlar-Vellum Cobalt. The vulnerability lies in the parsing of AR files where memory is not properly initialized, enabling a remote code execution when a user opens a malicious AR file or visits a malicious page. The issue requires user interaction and could allow code exec...

CVE-2023-35716

Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution vulnerability. An attacker can exploit AR file parsing by triggering a read past the end of an allocated buffer, allowing arbitrary code execution in the process. Exploit requires user interaction (visiting a malicious ...

CVE-2023-35715 Ashlar-Vellum Cobalt AR File Parsing Uninitialized Memory Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt AR File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must...