Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router

Dave McDaniel of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered an exploitable information disclosure vulnerability in the D-LINK DIR-3040 smart WiFi mesh router that could allow an adversary to eventually turn off the device or remove other... Thi...

D-Link DIR-615 Buffer Overflow Vulnerability

The D-Link DIR-615 is a wireless router from D-Link, a Taiwan-based company. The security vulnerability in the D-Link DIR-615 stems from a network system or product that does not properly validate data boundaries when performing operations on memory, resulting in incorrect read and write operatio...

D-LINK DIR-3040 WiFi Smart Mesh information disclosure vulnerability

Summary An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger this vulnerability. Tested Versions D-LINK DIR-3040...

D-LINK DIR-3040 信任管理问题漏洞

D-LINK DIR-3040 is a router from D-Link Taiwan, China. The WiFi Smart Mesh feature of the D-LINK DIR-3040 1.13B03 is vulnerable to information disclosure. An attacker could exploit the vulnerability with a specially crafted network request to cause command execution...

CVE-2021-21913: Use of Hard-coded Credentials

An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger this vulnerability...

CVE-2021-24639

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgfajaxemptydir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server...

CVE-2021-24639

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgfajaxemptydir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server...

PT-2021-4897

Name of the Vulnerable Software and Affected Versions D-LINK-DIR-605 B2 Firmware version 2.01MT Description An information disclosure issue exists, allowing an attacker to obtain a user name and password by forging a post request to the "getcfg.php" page. This is due to insufficient protection of...

PT-2021-6122

Name of the Vulnerable Software and Affected Versions D-Link DIR-X1860 versions prior to v1.10WWB09 Beta Description The issue is related to a reflected cross-site-scripting attack in the web application of the D-Link DIR-X1860. This allows a remote unauthenticated attacker to execute code in the...

PT-2021-6117

Name of the Vulnerable Software and Affected Versions D-Link DIR-X1860 versions prior to v1.10WWB09 Beta Description The issue is related to a web application vulnerability in the D-Link DIR-X1860 Wi-Fi router's firmware, specifically concerning inadequate handling of HTTP requests. This can be...

D-Link DIR-2055 HNAP incorrect comparison verification bypass vulnerability

The D-Link DIR-2055 is a router device. a security vulnerability exists in the D-Link DIR-2055 HNAP, which can be exploited by attackers to execute arbitrary code on the router...

D-Link DIR-2055 HNAP PrivateLogin incorrect authentication algorithm implements authentication bypass vulnerability

D-Link DIR-2055 is a router device. a security vulnerability exists in the D-Link DIR-2055 HNAP PrivateLogin authentication algorithm, which can be exploited by attackers to escalate privileges and execute arbitrary code in the router context...

D-Link DIR-816 Command Execution Vulnerability

D-Link DIR-816 is a wireless router from D-Link Taiwan, China.A security vulnerability exists in D-Link DIR-816A1FW101CNB04 750m11ac. The vulnerability is caused by a flaw in the handler function of the /goform/form2userconfig.cgi route. Through the use of HTTP request parameters, an attacker cou...

(0Day) D-Link DIR-2055 HNAP PrivateLogin Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2055 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of...

D-Link DIR-816 Command Execution Vulnerability (CNVD-2021-67516)

The D-Link DIR-816 is a wireless router from D-Link, Taiwan, China.The D-Link DIR-816 has a security vulnerability that could be exploited by attackers to execute arbitrary php code via the typename parameter...

(0Day) D-Link DIR-2055 HNAP Incorrect Comparison Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2055 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of...

CVE-2021-39509

An issue was discovered in D-Link DIR-816 DIR-816A2FWv1.10CNB05R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell...

CVE-2021-39509

An issue was discovered in D-Link DIR-816 DIR-816A2FWv1.10CNB05R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell...

CVE-2021-39509

A command injection vulnerability exists in the D-Link DIR-816 (specifically model DIR-816A2 with firmware FWv1.10CNB05_R1B011D88210 ) due to improper neutralization of special elements used in a command. The HTTP request parameter used in the handler function of the /goform/form2userconfig.cgi r...

CVE-2021-39509: Improper Neutralization of Special Elements used in a Command

An issue was discovered in D-Link DIR-816 DIR-816A2FWv1.10CNB05R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell...