CVE-2019-19597

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAPAUTH HTTP header...

CVE-2019-19597

The D-Link DAP-1860 WiFi range extender is vulnerable to arbitrary remote code execution as root without authentication. The root cause is the improper handling of shell metacharacters within the HNAP_AUTH HTTP header . Affected devices are those running firmware versions before v1.04b03 Beta . S...

CVE-2019-19598

D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAPAUTH header timestamp value. In HTTP requests, part of the HNAPAUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to...

CVE-2019-19598

CVE-2019-19598 affects D-Link DAP-1860 devices prior to v1.04b03 Beta. The vulnerability allows bypassing authentication to access administrator functions via the HNAP_AUTH header timestamp; if the timestamp matches the device’s /var/hnap/timestamp value, the HNAP_AUTH check passes. This is an ad...

D-Link DAP-1860 Authorization Issues Vulnerability

The D-Link DAP-1860 is a WiFi range extender from AUO D-Link of Taiwan, China. The D-Link DAP-1860 is vulnerable to an authorization issue. An attacker can exploit the vulnerability to gain unauthenticated access to administrator functions with the help of a timestamp value in the HNAPAUTH header...

PT-2019-15883

Name of the Vulnerable Software and Affected Versions D-Link DAP-1860 versions prior to v1.04b03 Beta Description The issue allows for arbitrary remote code execution as root without authentication. This is achieved via shell metacharacters within an HNAP AUTH HTTP header. Recommendations For...

PT-2019-15884

Name of the Vulnerable Software and Affected Versions D-Link DAP-1860 versions prior to v1.04b03 Beta Description The issue allows access to administrator functions without authentication by manipulating the HNAP AUTH header timestamp value in HTTP requests. This value is compared to the one stor...

CVE-2019-19598: Improper Authentication

D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAPAUTH header timestamp value. In HTTP requests, part of the HNAPAUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to...

CVE-2019-19597: Incorrect Authorization

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAPAUTH HTTP header...

D-Link DAP-1860 Remote Code Execution Vulnerability

The D-Link DAP-1860 is a WiFi range extender from AUO D-Link of Taiwan, China. A remote code execution vulnerability exists in the D-Link DAP-1860. The vulnerability can be exploited by an attacker to execute arbitrary code with root privileges with the help of shell metacharacters in the HNAPAUT...