CVE-2023-34942

Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2023-34941

A stored cross-site scripting XSS vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL Keyword List text field. NOTE: This vulnerability only affects products that are no...

PT-2023-25068 · Asus · Asus Rt-N10Lx Router

Name of the Vulnerable Software and Affected Versions: Asus RT-N10LX Router version 2.0.0.39 Description: A stack overflow issue was discovered via the url parameter at the "/start-apply.html" API endpoint. This issue only affects products that are no longer supported by the maintainer...

CVE-2023-24229

DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2022-47065

TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects...

CVE-2021-39613

D-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As weak passwords have been used, the plaintext passwords can be recovered from the hash values. NOTE: This vulnerability only affects products...

Multiple Buffalo network devices contain hidden functionality

Overview Multiple network devices provided by BUFFALO INC. contain hidden functionality CWE-912 that allows an attacker to enable the debug option. Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact A network-adjacent attacker...

Command injection

UNSUPPORTED WHEN ASSIGNED An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet...

Buffer overflow

UNSUPPORTED WHEN ASSIGNED D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

PT-2021-19527 · D Link · D-Link Dcs-5220

Name of the Vulnerable Software and Affected Versions: D-Link DCS-5220 affected versions not specified Description: The issue is a buffer overflow. It affects D-Link DCS-5220 devices that are no longer supported by the maintainer. Recommendations: At the moment, there is no information about a...

CVE-2020-25786

webinc/js/info.php on D-Link DIR-816L 2.06.B09BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: this is typically not exploitable because of URL encoding except in Internet...

CVE-2020-9377

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

PT-2020-6844

Name of the Vulnerable Software and Affected Versions D-Link DIR-610 devices affected versions not specified Description The issue allows for Remote Command Execution via the cmd parameter to "command.php". This is due to the lack of measures to neutralize special elements used in the operating...