CVE-2022-43626

CVE-2022-43626 affects the D-Link DIR-1935 (version 1.03). The flaw is in the web management SetIPv4FirewallSettings handling of IPv4FirewallRule elements, where a user-supplied string isn’t properly validated before it’s used in a system call, enabling arbitrary code execution in the root contex...

D-Link DIR-1935 安全漏洞

The D-Link DIR-1935 is a wireless router from China-based D-Link. A security vulnerability exists in the D-Link DIR-1935 that originates when parsing the HNAPAUTH header, where the process does not properly validate the length of user-supplied data before copying it into a fixed-length buffer...

CVE-2022-43622

CVE-2022-43622 affects D-Link DIR-1935 devices (version 1.03). The flaw is in handling of the Login requests to the web management portal: during parsing of the HNAP_AUTH header, the length of user-supplied data is not properly validated before copying into a fixed-size stack buffer, enabling a s...

CVE-2022-43627: Improper Neutralization of Special Elements used in an OS Command

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43620: Improper Authentication

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the la...

CVE-2022-43629: Improper Neutralization of Special Elements used in an OS Command

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43631: Improper Neutralization of Special Elements used in an OS Command

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43625: Stack-based Buffer Overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43643: Improper Neutralization of Special Elements used in an OS Command

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Generic plugin for the xupnpd service, which listens on TC...

CVE-2022-43623: Improper Neutralization of Special Elements used in a Command

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43633: Improper Neutralization of Special Elements used in an OS Command

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43619: Use of Externally-Controlled Format String

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43632: Improper Neutralization of Special Elements used in an OS Command

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

D-Link DIR-3040 安全漏洞

D-Link DIR-3040 is a router from China Youxun D-Link Inc. The D-Link DIR-3040 is vulnerable to a buffer overflow vulnerability caused by a failure to properly boundary check the MiniDLNA service. An attacker could exploit this vulnerability to execute arbitrary code on the system...

CVE-2022-43644

CVE-2022-43644 affects D-Link DIR-825 routers (version 1.0.9/EE). The vulnerability originates in the Dreambox plugin for the xupnpd service, which listens on TCP port 4044. It stems from improper validation of a user-supplied string before it is used to execute a system call, allowing network-ad...

D-Link DIR-825 操作系统命令注入漏洞

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call using it...

D-Link DIR-1935 授权问题漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an authorization issue vulnerability that stems from not properly implementing the authentication algorithm...

D-Link DIR-825 操作系统命令注入漏洞

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call using it...

CVE-2022-43623

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43625

CVE-2022-43625 affects D-Link DIR-1935 (firmware 1.03). The vulnerability lies in the NetMask handling inside the web management portal when processing SetStaticRouteIPv4Settings requests; the value is copied into a fixed-length stack buffer without proper length validation, enabling a stack-base...