CVE-2019-7390: Missing Authentication for Critical Function

An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API...

PT-2019-18573

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G firmware 1.02B03 Description An issue was discovered allowing remote attackers to get sensitive information, such as MAC addresses, about all clients in the WLAN via the "GetClientInfo HNAP API" endpoint. This is due to incorre...

PT-2019-18574

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G version 1.02B03 Description An issue was discovered in the /bin/goahead binary, allowing remote attackers to reset the router without authentication via the "SetFactoryDefault" HNAP API endpoint "/bin/goahead". This incorrect...

CVE-2019-7298

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

Command injection

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

CVE-2019-7298

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

CVE-2019-7298

Summary: CVE-2019-7298 affects the D-Link DIR-823G family (firmware up to 1.02B03). The vulnerability is an OS command injection in HNAP processing: any HNAP API function can trigger a call to the system() function using untrusted input from the request body, enabling remote command execution. An...

CVE-2019-7298

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

PT-2019-1516

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G versions through 1.02B03 Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of this issue may allow a remote attacker to execute arbitrary...

PT-2019-2535

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G firmware 1.02B03 Description The issue is related to incorrect access control in the /bin/goahead executable, allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN without authentication...

CVE-2019-7298: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

Command injection

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

CVE-2019-7297 affects D-Link DIR-823G devices with firmware up to 1.02B03. A command-injection vulnerability exists in the /HNAP1 interface: GetNetworkTomographyResult calls system with an untrusted Address input, allowing remote attackers to execute arbitrary OS commands via crafted requests. Ex...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2018-19041

The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

CVE-2018-19040

The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

PT-2019-1345 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G devices with firmware through 1.02B03 Description: An issue allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls...

CVE-2019-7297: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...