CVE-2019-16412

The CVE concerns a vulnerability in Tenda N301 wireless routers affecting the goform/setSysTools handler. A zero wanMTU value can be submitted and, unlike in the GUI which blocks it, may trigger a device crash. The issue is documented with the same description across NVD/Red Hat/NVD mirrors, conf...

PT-2019-14668

Name of the Vulnerable Software and Affected Versions Tenda N301 wireless routers affected versions not specified Description The issue allows attackers to trigger a device crash by setting a zero wanMTU value in the goform/setSysTools endpoint. Although the GUI enforces a prohibition on this zer...

CVE-2019-16412: Improper Input Validation

In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. Prohibition of this zero value is only enforced within the GUI...

Cross site request forgery (csrf)

On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash...

CVE-2019-16288

CVE-2019-16288 affects the Tenda N301 wireless router. A long string in the wifiSSID parameter of a goform/setWifi POST request can cause the device to crash due to input handling/validation issues. Affected component: the wifi configuration handling in the web interface/goform API. Impact per so...

PT-2019-14612

Name of the Vulnerable Software and Affected Versions Tenda N301 version affected versions not specified Description The issue occurs when a long string is sent in the wifiSSID parameter of a "goform/setWifi" POST request, causing the device to crash. Recommendations For the affected Tenda N301...

CVE-2019-16288: Undefined Security Weakness

On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash...

PT-2019-7659

Name of the Vulnerable Software and Affected Versions Edimax Wi-Fi Extender devices affected versions not specified Description The issue allows for CSRF, potentially leading to PSK key disclosure through the goform/formwlencryptvxd endpoint. Recommendations At the moment, there is no information...

CVE-2016-10863: Cross-Site Request Forgery (CSRF)

Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure...

CVE-2019-10660: Improper Neutralization of Special Elements used in an OS Command

Grandstream GXV3611IRHD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field...

D-Link DIR-816 A2 Router System Account Editing Vulnerability

The D-Link DIR-816 A2 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-816 A2 version 1.11, which stems from the program only checking for random tokens when authorizing a goform request. An attacker can exploit the vulnerability by obtainin...

D-Link DIR-816 A2 Router Web or System Account Editing Vulnerability

The D-Link DIR-816 A2 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-816 A2 version 1.11, which stems from the program only checking for random tokens when authorizing a goform request. The vulnerability can be exploited to edit web and...

CVE-2019-10042

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication...

Authentication flaw

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

PT-2019-11394

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.11 Description: The issue concerns the authorization process for goform requests, where the router only checks a random token. This token can be obtained from dir login.asp, allowing an attacker to use the "API URL...

PT-2019-11392

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.11 Description: The issue concerns the authorization process of the router, where it only checks a random token when authorizing a goform request. This allows an attacker to obtain the token from dir login.asp and...

PT-2019-11393

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.11 Description: The issue allows an attacker to edit the system account without authentication by exploiting the fact that the router only checks the random token when authorizing a goform request. The token can be...

PT-2019-11391

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.11 Description: The issue allows an attacker to edit the web or system account without authentication by exploiting the fact that the router only checks the random token when authorizing a goform request. This toke...

CVE-2019-10042: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication...

CVE-2019-10041: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication...