PT-2019-8632

Name of the Vulnerable Software and Affected Versions D-Link DCS-1130 devices affected versions not specified Description An issue was discovered where the device does not enforce username and password restrictions on a specific URL, allowing attackers to view the live video feed. There are more...

PT-2019-8634

Name of the Vulnerable Software and Affected Versions D-Link DCS-1130 devices affected versions not specified Description An issue was discovered on D-Link DCS-1130 devices, where the device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device...

PT-2019-8635

Name of the Vulnerable Software and Affected Versions D-Link DCS-1100 affected versions not specified D-Link DCS-1130 affected versions not specified Description An issue was discovered on D-Link devices, where a custom binary called mp4ts under the /var/www/video folder dumps the HTTP VERB in th...

PT-2019-8629

Name of the Vulnerable Software and Affected Versions D-Link DCS-1130 devices affected versions not specified Description An issue was discovered where the device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows a hosted flash file on any domain to...

PT-2019-8627

Name of the Vulnerable Software and Affected Versions D-Link DCS-1130 devices affected versions not specified Description An issue was discovered on D-Link DCS-1130 devices, where the device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device...

PT-2019-8630

Name of the Vulnerable Software and Affected Versions D-Link DCS-1130 devices affected versions not specified Description An issue was discovered where the device does not implement any cross-site request forgery protection mechanism. This allows an attacker to trick a user who is logged in to th...

PT-2019-8633

Name of the Vulnerable Software and Affected Versions D-Link DCS-1100 affected versions not specified D-Link DCS-1130 affected versions not specified Description An issue was discovered in the binary rtspd in the /sbin folder of the devices, which handles all rtsp connections. The binary performs...

PT-2019-8636

Name of the Vulnerable Software and Affected Versions D-Link DCS-1100 affected versions not specified D-Link DCS-1130 affected versions not specified Description An issue was discovered in D-Link devices, where a custom daemon runs on UDP port 5978, handling a custom D-Link UDP-based protocol. Th...

PT-2019-8637

Name of the Vulnerable Software and Affected Versions D-Link DCS-1100 affected versions not specified D-Link DCS-1130 affected versions not specified Description An issue was discovered on D-Link devices, where the binary orthrus in the /sbin folder handles UPnP connections. The binary performs a...

PT-2019-8638

Name of the Vulnerable Software and Affected Versions D-Link DCS-1100 affected versions not specified D-Link DCS-1130 affected versions not specified Description An issue was discovered on D-Link devices, where a custom telnet daemon as part of the busybox retrieves the password from the shadow...

PT-2019-8640

Name of the Vulnerable Software and Affected Versions D-Link DCS-1100 affected versions not specified D-Link DCS-1130 affected versions not specified Description An issue was discovered where D-Link devices allow communication with D-Link apps on mobile devices and desktops without authentication...

CVE-2017-8417: Undefined Security Weakness

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part o...

CVE-2017-8405: Improper Authentication

An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be...

PT-2019-8628

Name of the Vulnerable Software and Affected Versions D-Link DCS-1130 affected versions not specified D-Link DCS-1100 affected versions not specified Description An issue was discovered in D-Link devices where the binary rtspd handles all rtsp connections. A flag called Authenticate indicates...

PT-2019-8639

Name of the Vulnerable Software and Affected Versions D-Link DCS-1100 D-Link DCS-1130 Description An issue was discovered in D-Link devices, where a custom daemon runs on UDP port 5978, handling a custom D-Link UDP-based protocol. This protocol allows D-Link mobile and desktop applications to...

CVE-2017-8415: Use of Hard-coded Credentials

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the use...

CVE-2017-8407: Cross-Site Request Forgery (CSRF)

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to...

CVE-2017-8413: Improper Neutralization of Special Elements used in a Command

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and...

CVE-2017-8414: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f"...

CVE-2017-8411: Improper Neutralization of Special Elements used in a Command

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request to test if email credentials and hostname sent to the device work...