Command injection

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

CVE-2019-9119

CVE-2019-9119 affects Motorola C1 and M2 routers (firmware 1.01 and 1.07). It is a Command Injection vulnerability where a crafted /HNAP1 POST can trigger system() with untrusted input in SetStaticRouteSettings (staticroute_list), enabling remote execution of arbitrary OS commands and a root shel...

CVE-2019-9121

The CVE-2019-9121 issue affects Motorola C1 and M2 devices (firmware 1.01 and 1.07). A command-injection vulnerability exists in the device OS via the SetSmartQoSSettings API triggered from untrusted input in the /HNAP1 POST request, demonstrated by shell metacharacters in the smartqos_priority_d...

CVE-2019-9118

CVE-2019-9118 affects Motorola C1 and M2 devices with firmware 1.01 and 1.07. The issue is a command injection in the HNAP API: when a function triggers a system() call with untrusted input from the request body (SetNTPServerSettings), crafted input (shell metacharacters in system_time_timezone) ...

CVE-2019-9120

The CVE-2019-9120 issue affects Motorola C1 and M2 routers (firmware 1.01 and 1.07). It is a Command Injection vulnerability that lets an attacker remotely execute arbitrary OS commands and obtain a root shell by crafting a /HNAP1 POST request. The flaw occurs when any HNAP API function triggers ...

CVE-2019-9121

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

CVE-2019-9120

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

CVE-2019-9118

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

CVE-2019-9117

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

PT-2019-6347 · D Link · D-Link Dir-878

Name of the Vulnerable Software and Affected Versions: D-Link DIR-878 version 1.12B01 Description: The issue is related to the misuse of the strncpy function, leading to a stack-based buffer overflow. This can be exploited remotely without authentication via the HNAP AUTH HTTP header, potentially...

D-Link DIR-878 Buffer Overflow Vulnerability

The D-Link DIR-878 is a wireless router from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the D-Link DIR-878 version 1.12B01. A remote attacker can exploit this vulnerability to execute code with the help of 'HNAPAUTH' HTTP header...

CVE-2019-8392

An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to enable Guest Wi-Fi via the SetWLanRadioSettings HNAP API to the web service provided by /bin/goahead...

CVE-2019-8392

The CVE affects D-Link DIR-823G routers running firmware 1.02B03. Root cause is improper access control permitting remote attackers to enable Guest Wi‑Fi via the SetWLanRadioSettings HNAP API on the web service at /bin/goahead. Documented impact is the ability to enable guest access remotely; no ...

CVE-2019-8317

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

CVE-2019-8312

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

CVE-2019-8314

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

CVE-2019-8319

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

Command injection

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

CVE-2019-8313

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

Command injection

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...