Tenda N301 Input Validation Error Vulnerability

The Tenda N301 is a wireless router from the Chinese company Tenda. An input validation error vulnerability exists in the Tenda N301. An attacker can exploit this vulnerability by sending the 'wifiSSID' parameter with a long string to goform/setWifi, causing the application to crash...

CVE-2019-16412

In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. Prohibition of this zero value is only enforced within the GUI...

CVE-2019-16412

The CVE concerns a vulnerability in Tenda N301 wireless routers affecting the goform/setSysTools handler. A zero wanMTU value can be submitted and, unlike in the GUI which blocks it, may trigger a device crash. The issue is documented with the same description across NVD/Red Hat/NVD mirrors, conf...

CVE-2019-16412: Improper Input Validation

In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. Prohibition of this zero value is only enforced within the GUI...

Cross site request forgery (csrf)

On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash...

CVE-2019-16288

CVE-2019-16288 affects the Tenda N301 wireless router. A long string in the wifiSSID parameter of a goform/setWifi POST request can cause the device to crash due to input handling/validation issues. Affected component: the wifi configuration handling in the web interface/goform API. Impact per so...

CVE-2019-16288: Undefined Security Weakness

On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash...

CVE-2016-10863: Cross-Site Request Forgery (CSRF)

Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure...

CVE-2019-10660: Improper Neutralization of Special Elements used in an OS Command

Grandstream GXV3611IRHD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field...

D-Link DIR-816 A2 Router Web or System Account Editing Vulnerability

The D-Link DIR-816 A2 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-816 A2 version 1.11, which stems from the program only checking for random tokens when authorizing a goform request. The vulnerability can be exploited to edit web and...

D-Link DIR-816 A2 Router System Account Editing Vulnerability

The D-Link DIR-816 A2 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-816 A2 version 1.11, which stems from the program only checking for random tokens when authorizing a goform request. An attacker can exploit the vulnerability by obtainin...

CVE-2019-10042

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication...

Authentication flaw

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

CVE-2019-10042: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication...

CVE-2019-10041: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication...

CVE-2019-10040: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

CVE-2019-10039: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/setSysAdm to edit the web or system account without authentication...

CVE-2018-20305: Out-of-bounds Write

D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address...

CVE-2018-20057

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...

PT-2018-3890 · D Link · D-Link Dir-605L +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B1 D-Link DIR-605L version 2.12B1 Description: An issue was discovered in the /bin/boa component of D-Link DIR-619L and DIR-605L devices. The goform/formSysCmd endpoint allows remote authenticated users to execute...