D-Link DIR-816L Command Injection Vulnerability

The D-Link DIR-816L is a wireless router from AUO D-Link of Taiwan, China. An operating system command injection vulnerability exists in version 2.x of the D-Link DIR-816L prior to 1.10b04Beta02. An attacker can exploit this vulnerability to inject arbitrary commands...

CVE-2020-15894

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by...

CVE-2020-15895

An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage...

CVE-2020-15893

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet...

Command injection

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet...

Design/Logic Flaw

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by...

Cross site scripting

An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage...

CVE-2020-15893

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet...

CVE-2020-15893

CVE-2020-15893 affects D-Link DIR-816L devices with 2.x firmware prior to 1.10b04Beta02. UPnP is enabled by default on UDP port 1900, allowing command injection via the Search Target field of SSDP M-SEARCH requests. Affected firmware: 2.x before 1.10b04Beta02. Mitigation: update to 1.10b04Beta02 ...

CVE-2020-15894

Affected product: D-Link DIR-816L devices (firmware 2.x prior to 1.10b04Beta02). Vulnerability: An exposed administration function in getcfg.php can be invoked to call services. An attacker can retrieve sensitive information (e.g., admin credentials) by manipulating the _POST_SERVICES parameter t...

CVE-2020-15894

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by...

CVE-2020-15895

D-Link DIR-816L devices (2.x) before 1.10b04Beta02 contain an XSS in webinc/js/info.php where the RESULT parameter is printed without output filtration. An attacker can inject arbitrary script in a victim’s browser, potentially enabling cookie-based credential theft and other browser-based attack...

CVE-2020-15895

An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage...

CVE-2020-15893: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet...

PT-2020-5981 · D Link · D-Link Dir-816L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816L versions 2.x before 1.10b04Beta02 Description: An issue exists in the Universal Plug and Play UPnP component of the D-Link DIR-816L device, where UPnP is enabled by default on port 1900. This allows an attacker to perform...

CVE-2020-15894: Missing Authentication for Critical Function

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by...

CVE-2020-15895: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage...

D-Link DIR-842 Authentication Vulnerability

The D-Link DIR-842 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the HNAP GetCAPTCHAsetting request processing in the D-Link DIR-842. The vulnerability originates from a network system or product that does not properly authenticate a user's identity. An...

D-Link DIR-867, DIR-878 and DIR-882 Authentication Bypass Vulnerabilities

The D-Link DIR-878 and D-Link DIR-867 are both a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the HNAP request handling in the DIR-867-US using firmware version 1.20B10 and earlier and the DIR-878 using firmware version 1.20B05 and earlier, which stems from...

D-Link DIR-842 HNAP GetCAPTCHAsetting Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results fro...