CVE-2017-12943

D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/showinfo.php?REQUIREFILE= absolute path traversal attack, as demonstrated by discovering the admin password...

Path traversal

D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/showinfo.php?REQUIREFILE= absolute path traversal attack, as demonstrated by discovering the admin password...

CVE-2017-12943

D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/showinfo.php?REQUIREFILE= absolute path traversal attack, as demonstrated by discovering the admin password...

CVE-2017-12943

CVE-2017-12943 affects D-Link DIR-600 Rev Bx devices with v2.x firmware. The vulnerability is an absolute path traversal in the endpoint model/__show_info.php?REQUIRE_FILE= which allows remote attackers to read passwords (admin credentials) from the device. Public mention in multiple sources (Exp...

CVE-2017-12943: Improper Limitation of a Pathname to a Restricted Directory

D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/showinfo.php?REQUIREFILE= absolute path traversal attack, as demonstrated by discovering the admin password...

PT-2017-12787 · D Link · Dir-600M

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600 Rev Bx versions 2.x Description: The issue allows remote attackers to read passwords via an absolute path traversal attack using the "model/ show info.php?REQUIRE FILE=" endpoint. This can be exploited to discover the admin...

RouterSploit - Router Exploitation Framework

The RouteSploit Framework is an open-source exploitation framework dedicated to embedded devices. It consists of various modules that aids penetration testing operations: exploits - modules that take advantage of identified vulnerabilities creds - modules designed to test credentials against...

D-link DIR-890L HNAP 未授权信息泄漏漏洞

HNAPHome Network Administration Protocol,家庭网络管理协议是一种基于SOAPSimple Object Access Protocol,简单对象管理协议的协议，和UPnP很像，通常被D-Link的”EZ”设置程序用来初始化设置路由器。 存在问题代码： / Grab a pointer to the SOAPAction header / SOAPAction = getenv"HTTPSOAPACTION"; / Skip authentication if the SOAPAction header contains...

D-Link DIR-600 跨站请求伪造漏洞

D-LINK DIR-600型号路由器后台Web管理界面中，form表单提交缺少CSRF toke防止CSRF攻击，导致攻击者可以通过在用户可能浏览的网页中构造设置路由器后台配置的恶意脚本发起CSRF攻击，修改路由器配置。 路由器ping功能区域form表单如图： 1. 使用浏览器打开exp.html，html内容如下 function ping var xhr1 = new XMLHttpRequest; xhr1.open"POST", "http://192.168.0.1/apply.cgi", true; xhr1.setRequestHeader"Accept",...

D-Link Devices UPnP SOAPAction-Header Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'D-Link Devices UPnP SOAPAction-Header Command Execution', 'Description' = %q Different D-Link Routers are vulnerable to OS command...

D-Link Devices HNAP SOAPAction-Header Command Execution

Different D-Link Routers are vulnerable to OS command injection in the HNAP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This module has been tested on a DIR-645 device. The following devices are also reported as affected:...

CVE-2014-100005

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DIR-600 router rev. Bx with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account or 2 enable remote management via a crafted configuratio...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DIR-600 router rev. Bx with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account or 2 enable remote management via a crafted configuratio...

CVE-2014-100005

CVE-2014-100005 affects D-Link DIR-600 (revision Bx) routers with firmware before 2.17b02. The vulnerability comprises multiple CSRF flaws that can hijack administrator sessions and perform actions such as creating an admin account, enabling remote management via hedwig.cgi, applying new settings...

CVE-2014-100005

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DIR-600 router rev. Bx with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account or 2 enable remote management via a crafted configuratio...

CVE-2014-100005

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DIR-600 router rev. Bx with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account or 2 enable remote management via a crafted configuratio...

CVE-2014-100005

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DIR-600 router rev. Bx with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account or 2 enable remote management via a crafted configuratio...

CVE-2014-100005: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DIR-600 router rev. Bx with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account or 2 enable remote management via a crafted configuratio...

D-Link DIR-600 and DIR-300 (rev B) Multiple Vulnerabilities

No description provided by source...

Multiple D-Link Devices - Multiple Vulnerabilities

No description provided by source. Exploit Title: Multiple Vulnerabilities in Dlink devices Date: 05.04.2013 Exploit Author: m-1-k-3 Vendor Homepage: http://www.dlink.de Software Link:...