D-Link DIR-615 安全漏洞

The D-Link DIR-615 is a wireless router from D-Link, a Taiwan-based company. The security vulnerability in the D-Link DIR-615 stems from a network system or product that does not properly validate data boundaries when performing operations on memory, resulting in incorrect read and write operatio...

CVE-2021-37388: Buffer Copy without Checking Size of Input

A buffer overflow in D-Link DIR-615 C2 3.03WW. The pingipaddr parameter in pingresponse.cgi POST request allows an attacker to crash the webserver and might even gain remote code execution...

CVE-2021-20115: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.3. The paths provided in the f, d, and dir parameters in tcefilemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link...

CVE-2021-20116: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.4. The paths provided in the f, d, and dir parameters in tceselectmediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious lin...

D-Link DIR-3040 < 1.13B03 Hotfix Multiple Vulnerabilities - Active Check

D-Link DIR-3040 devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/o:dlink"; if...

Cross site request forgery (csrf)

On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request...

多款 Crestron 设备授权问题漏洞

Crestron Electronics Crestron DM-NVX-DIR and DM-NVX-ENT are both virtual switching devices from Crestron Electronics, Inc. An authorization issue vulnerability exists in multiple Crestron devices where an attacker can send an unauthenticated Websocket request to change a password because the devi...

CVE-2020-16839

On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request...

CVE-2020-16839

This CVE affects Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices prior to patch DM-XIO/1-0-3-802. The root issue is an unauthenticated WebSocket request that allows changing the device password, indicating a lack of proper permission validation on the WebSocket API. The vulnerability is...

CVE-2020-16839: Improper Authentication

On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request...

D-LINK DIR-3040 Libcli 命令注入漏洞(CVE-2021-21819)

The DIR-3040 is an AC3000-based wireless internet router. As discussed in TALOS-2021-1285, a hidden telnet service can be started without authentication by visiting https:///starttelnet This service presents the user with a login prompt for their “libcli test environment”: $ telnet 192.168.0.1...

D-LINK DIR-3040 Zebra IP 路由管理器信息泄露漏洞(CVE-2021-21817)

The DIR-3040 is an AC3000-based wireless internet router. Zebra is an IP routing manager that provides kernel routing table updates, interface lookups, and redistribution of routes between different routing protocols. The DIR-3040 runs this service by default on TCP port 2601 and can be accessed ...

D-LINK DIR-3040 服务组件使用默认密码（CVE-2021-21818）

The DIR-3040 is an AC3000-based wireless internet router. Zebra is an IP routing manager that provides kernel routing table updates, interface lookups, and redistribution of routes between different routing protocols. The DIR-3040 runs this service by default on TCP port 2601 and can be accessed ...

D-LINK DIR-3040 Trust Management Issue Vulnerability (CNVD-2021-53335)

D-LINK DIR-3040 is a router from D-Link, Taiwan, China. A trust management issue vulnerability exists in the D-LINK DIR-3040, which stems from the product's Zebra IP Routing Manager feature.The lack of an effective trust management mechanism in the Zebra IP Routing Manager feature of the D-LINK...

D-LINK DIR-3040 Information Disclosure Vulnerability (CNVD-2021-53338)

The D-LINK DIR-3040 is a router from D-Link, a Taiwan-based company that provides connectivity to the Internet.The D-LINK DIR-3040 is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to send HTTP requests resulting in the disclosure of sensitive...

D-LINK DIR-3040 Trust Management Issue Vulnerability

The D-Link DIR-3040 is a router from AUO D-Link of Taiwan, China. It provides the function of connecting to a network. A trust management issue vulnerability exists in Libcli for D-LINK DIR-3040 1.13B03, which stems from a specially designed network request can lead to code execution. No detailed...

CVE-2021-21819

A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2021-21820

A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2021-21820

A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2021-21818

A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to a denial of service. An attacker can send a sequence of requests to trigger this vulnerability...