The vulnerability of the formSetWanL2TPcallback() function in the file /goform/formSetWanL2TPtriggers of the D-Link DIR-513 router’s microprogramming software allows a hacker to induce a service failure.

The vulnerability of the formSetWanL2TPcallback function in the file /goform/formSetWanL2TPtriggers of the D-Link DIR-513 router’s microprogramming software is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to...

CVE-2013-10069

The web interface of multiple D-Link routers, including DIR-600 rev B ≤2.14b01 and DIR-300 rev B ≤2.13, contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to...

CISA Adds 3 D-Link Vulnerabilities to KEV Catalog Amid Active Exploitation Evidence

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added three old security flaws impacting D-Link Wi-Fi cameras and video recorders to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation in the wild. The high-severity vulnerabilities,...

PT-2025-32147 · Undefined · Undefined

CISA adds three D-Link router flaws to KEV due to active exploitation, including remote password disclosure and command injection from 2020-2022. Firmware fixes exist, but CVE-2020-40799 remains unpatched. RouterSecurity US Vulnerabilities https://t.co/1UBwSWW1hk...

The vulnerability of the getAuthCode() function in D-Link DIR-605L router microprogramming software allows a hacker to execute any code with root privileges.

The vulnerability of the getAuthCode function in D-Link DIR-605L router microprogramming software is related to buffer overflows in the CAPTCHA processing stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

CVE-2013-10069

The web interface of multiple D-Link routers, including DIR-600 rev B ≤2.14b01 and DIR-300 rev B ≤2.13, contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to...

CVE-2013-10069 D-Link Devices Unauthenticated RCE

The web interface of multiple D-Link routers, including DIR-600 rev B ≤2.14b01 and DIR-300 rev B ≤2.13, contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to...

CVE-2013-10069 D-Link Devices Unauthenticated RCE

The web interface of multiple D-Link routers, including DIR-600 rev B ≤2.14b01 and DIR-300 rev B ≤2.13, contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to...

CVE-2013-10069

The CVE-2013-10069 entry describes an unauthenticated OS command injection in the web interface (command.php) of multiple D-Link routers, specifically DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13). The flaw arises from improper handling of the cmd POST parameter, enabling a remote attacker t...

D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users should discontinue product utilization...

D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users should discontinue product utilization...

VulnCheck KEV: CVE-2022-40799

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L = 2.60B15 allows an authenticated attacker to execute OS level commands on the device...

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddnsenc.cgi. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users should discontinue product utilization...

CVE-2013-10048

An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 firmware ≤ 2.13 and ≤ 2.14b01, respectively—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker c...

CVE-2013-10050

An OS command injection vulnerability exists in multiple D-Link routers—confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13—via the authenticated toolsvct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid...

CVE-2013-10059

An authenticated OS command injection vulnerability exists in various D-Link routers tested on DIR-615H1 running firmware version 8.04 via the toolsvct.htm endpoint. The web interface fails to sanitize input passed from the pingipaddr parameter to the toolsvct.htm diagnostic interface, allowing...

The vulnerability in the proxy_client.asp script of the D-Link DI-7300G+ router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the proxyclient.asp script in the D-Link DI-7300G+ router microprogramming system is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary command...

The vulnerability of the formSetWizard1() function in the /goform/formSetWizard1 file of the D-Link DIR-619L router’s microprogramming system, which allows a hacker to cause a service failure.

The vulnerability of the formSetWizard1 function in the /goform/formSetWizard1 file of the D-Link DIR-619L router’s microprogramming system is related to the issue where the operation’s output goes beyond the buffer in memory when processing the curTime parameter. Exploiting this vulnerability...

The vulnerability of D-Link DI-7300G+ and DI-8200G router microprogramming software lies in the lack of measures to neutralize special elements, allowing attackers to execute arbitrary commands.

The vulnerability of D-Link DI-7300G+ and DI-8200G router microprogramming software lies in the lack of measures taken to neutralize special elements when processing parameters such as flag, cmd, and iface on the mspinfo.htm page. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability of the ipsec_net_asp() function in D-Link DI-8200 router software allows a attacker to cause a service failure.

The vulnerability of the ipsecnetasp function in D-Link DI-8200 router microprogramming software is related to buffer overflows in the stack when processing the remotip parameter. Exploiting this vulnerability can allow a remote attacker to cause a service failure...