CVE-2020-9277

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

CVE-2020-9279

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device...

CVE-2020-9275

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. A cfm UDP service listening on port 65002 allows remote, unauthenticated exfiltration of administrative credentials...

CVE-2020-9278

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The device can be reset to its default configuration by accessing an unauthenticated URL...

Default configuration

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The device can be reset to its default configuration by accessing an unauthenticated URL...

Authentication flaw

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

Design/Logic Flaw

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. A cfm UDP service listening on port 65002 allows remote, unauthenticated exfiltration of administrative credentials...

Stack overflow

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The function docgi, which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with...

Hardcoded credentials

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device...

CVE-2020-9279

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device...

CVE-2020-9279

CVE-2020-9279 affects D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded management-interface account allows login with high privileges, enabling the attacker to perform critical tasks and take full control of the device. The issue is exploitable remotely over the management interface (network ac...

CVE-2020-9278

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The device can be reset to its default configuration by accessing an unauthenticated URL...

CVE-2020-9278

CVE-2020-9278 affects the D-Link DSL-2640B B2 EU_4.01B router. The vulnerability allows an unauthenticated user to reset the device to its default configuration by accessing unauthenticated URLs, enabling a factory reset. Technical details referenced in connected documents include specific endpoi...

CVE-2020-9277

The CVE-2020-9277 entry concerns D-Link DSL-2640B B2 EU_4.01B devices, where authentication can be bypassed when accessing CGI modules, enabling an attacker to perform administrative tasks (e.g., changing the admin password) with no authentication. The vulnerability stems from the CGI handling on...

CVE-2020-9277

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

CVE-2020-9276

The CVE-2020-9276 entry concerns the D-Link DSL-2640B B2 EU_4.01B device. The do_cgi() function, which processes CGI requests on the device’s web server, is vulnerable to a remotely exploitable stack-based buffer overflow. Exploitation can be unauthenticated and is possible when combined with CVE...

CVE-2020-9276

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The function docgi, which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with...

CVE-2020-9275

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. A cfm UDP service listening on port 65002 allows remote, unauthenticated exfiltration of administrative credentials...

CVE-2020-9275

The CVE-2020-9275 entry concerns D-Link DSL-2640B B2 EU_4.01B devices. A cfm UDP service listening on port 65002 is reachable remotely without authentication, enabling exfiltration of administrative credentials. This indicates a remote access risk where an attacker could obtain credentials throug...

D-Link DSL-GS225 J1 OS Command Injection Vulnerability

The D-Link DSL-GS225 J1 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DSL-GS225 J1 AU1.0.4 version. The vulnerability can be exploited to execute operating system commands by placing shell metacharacters after supported CLI commands...