CVE-2020-15631

The CVE-2020-15631 issue affects D-Link DAP-1860 with firmware 1.04B03_HOTFIX and involves the HNAP service. The flaw occurs when parsing the SOAPAction header on port 80, where a user-supplied string is used to spawn a system call without proper validation, allowing network-adjacent attackers to...

CVE-2020-15631: Improper Neutralization of Special Elements used in an OS Command

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03HOTFIX WiFi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

D-Link DAP-1522 Authentication Bypass Vulnerability

The D-Link DAP-1522 is a wireless access point product from AUO D-Link of Taiwan, China. A security vulnerability exists in version 1.4x of the D-Link DAP-1522 prior to 1.10b04Beta02. An attacker can exploit the vulnerability to bypass authentication and gain direct access to the application...

CVE-2020-15896

An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NONEEDAUTH. If the value of NONEEDAUTH is...

CVE-2020-15896

An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NONEEDAUTH. If the value of NONEEDAUTH is...

CVE-2020-15892

An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length...

Stack overflow

An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length...

Authentication flaw

An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NONEEDAUTH. If the value of NONEEDAUTH is...

CVE-2020-15892

The CVE-2020-15892 issue affects D-Link DAP-1520 firmware (pre-1.10b04Beta02) in apply.cgi. The login flow forwards POST values to an ssi binary, and client-side validation limits the password to 15 chars, which can be bypassed. An attacker intercepting a login POST and modifying the vulnerable p...

CVE-2020-15892

An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length...

CVE-2020-15896

CVE-2020-15896 affects D-Link DAP-1522 devices with firmware 1.4x prior to 1.10b04Beta02. The root cause is improper handling of NO_NEED_AUTH: when NO_NEED_AUTH equals 1, protected pages (e.g., logout.php, login.php) are accessible without authentication, enabling an authentication bypass. Docume...

CVE-2020-15896

An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NONEEDAUTH. If the value of NONEEDAUTH is...

CVE-2020-15896: Improper Authentication

An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NONEEDAUTH. If the value of NONEEDAUTH is...

CVE-2020-15892: Incorrect Resource Transfer Between Spheres

An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length...

PT-2020-14694

Name of the Vulnerable Software and Affected Versions D-Link DAP-1522 devices versions 1.4x through 1.10b04Beta01 Description An authentication-bypass issue allows unauthorized users to access certain pages directly. This is due to the checking of the NO NEED AUTH value. If NO NEED AUTH is set to...

PT-2020-14691 · D Link · D-Link Dap-1520

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1520 versions prior to 1.10b04Beta02 Description: An issue was discovered in the apply.cgi of D-Link DAP-1520 devices. The problem arises when a user performs a login action from the web interface, and the request values are...

D-Link DAP-1860 OS Command Injection Vulnerability

The D-Link DAP-1860 is a WiFi range extender from AUO D-Link of Taiwan, China. An operating system command injection vulnerability exists in the HNAP service in the D-Link DAP-1860 using firmware version 1.04b01 and earlier, where the program fails to properly validate user-submitted characters...

D-Link DAP-1860 HNAP SOAPAction Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 WiFi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

PT-2020-14554

Name of the Vulnerable Software and Affected Versions D-Link DAP-1860 version 1.04B03 HOTFIX Description This issue allows network-adjacent attackers to execute arbitrary code on affected devices. Although authentication is required, the existing authentication mechanism can be bypassed. The flaw...

D-Link DAP-1360 Elevation of Privilege Vulnerability

The D-Link DAP-136 is a wireless network signal extender from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DAP-1360 all Fx hardware versions using firmware version v6.13EUb01 and earlier. An attacker could exploit the vulnerability to start a remote terminal protocol...