CVE-2019-16920

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a “PingTest” device common gateway interface that could lead to common injection. An attacker who successfully triggers...

D-Link DIR-825 Cross-Router Hidden Channel Vulnerability

The D-Link DIR-825 is an AC 1200 Wi-Fi dual-band Gigabit LAN/WAN router. A cross-router hidden channel vulnerability exists in the D-link DIR-825 G1. The vulnerability stems from insufficient isolation between host and client networks established by the same device. The vulnerability can be...

D-Link Administrative Password Disclosure

The problem in the following models : DIR-652 DIR-615 DIR-827 DIR-615 DIR-657 DIR-825 If login to web interface as "User" or "user" , and navigate to url : http://:port/wizardwan.asp in web code page: view-source::port/wizardwan.asp scroll down page and bang : administrator password in plain text...

D-Link DIR-825 Default Credentials (HTTP)

D-Link DIR-825 devices use an empty default password for the accounts SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

D-Link DIR-825 Information Disclosure Vulnerability

D-Link DIR-825 devices are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-9123

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password...

CVE-2019-9123

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password...

CVE-2019-9126

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the routerinfo.xml document. This will reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN...

CVE-2019-9126

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the routerinfo.xml document. This will reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN...

CVE-2019-9122

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntpserver parameter in an ntpsync.cgi POST request...

Cross site request forgery (csrf)

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntpserver parameter in an ntpsync.cgi POST request...

CVE-2019-9122

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntpserver parameter in an ntpsync.cgi POST request...

Default credentials

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password...

Information disclosure

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the routerinfo.xml document. This will reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN...

CVE-2019-9123

CVE-2019-9123 affects D-Link DIR-825 Rev.B 2.10 devices. The issue is an empty password on the 'user' account, enabling remote login over the network. Impact described in sources includes unauthorized access with network vector and high/critical severity. Remediation in the documents includes cha...

CVE-2019-9122

The CVE-2019-9122 issue affects D-Link DIR-825 Rev.B firmware 2.10. An input validation flaw in the ntp_sync.cgi endpoint allows a remote attacker to pass ntp_server in a POST request to execute arbitrary commands, giving remote code execution with high impact (C/H/I/H) per CVSS 3.1. Exploitation...

CVE-2019-9126

CVE-2019-9126 affects D-Link DIR-825 Rev.B 2.10 devices. The vulnerability is an information disclosure through requests to the router_info.xml document, leading to exposure of the device’s PIN code, MAC address, routing table, firmware version, update time, QoS and other LAN/WLAN information. Th...

CVE-2019-9123

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password...

CVE-2019-9126

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the routerinfo.xml document. This will reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN...

CVE-2019-9122

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntpserver parameter in an ntpsync.cgi POST request...