CVE-2018-17440

D-Link Central WiFi Manager (before 1.03r0100-Beta1) is vulnerable to remote code execution via an FTP service listening on port 9000 that uses hardcoded admin/admin credentials. An unauthenticated attacker can upload a PHP file to the web root and access it to execute arbitrary code. Core Securi...

CVE-2018-17443

CVE-2018-17443 affects D-Link Central WiFi Manager prior to 1.03r0100-Beta1. The vulnerability is a stored XSS in the sitename parameter of the UpdateSite endpoint, enabling injection of arbitrary script/HTML when a user visits the affected page. Public details in connected sources confirm the is...

CVE-2018-17443

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XSS...

CVE-2018-17441

CVE-2018-17441 affects D-Link Central WiFi Manager prior to version 1.03r0100-Beta1. The vulnerability is a stored XSS in the addUser endpoint’s username parameter, enabling injection of web scripts into the UI. Impact per sources is limited to client-side script execution; no server-side comprom...

CVE-2018-17441

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS...

CVE-2018-17442

CVE-2018-17442 affects D-Link Central WiFi Manager prior to version 1.03r0100-Beta1. The vulnerability lies in an unrestricted file upload via the onUploadLogPic endpoint, which can be exploited by remote authenticated users to achieve remote code execution (PHP) by uploading a crafted archive (....

PT-2018-2192 · D Link · D-Link Central Wifimanager Cwm-100

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFiManager CWM-100 version 1.03 r0098 Description: The issue is related to the FTP service, which allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in a Server-Side Request Forgery SSRF...

PT-2018-2075 · D Link · D-Link Central Wifi Manager

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: An issue exists due to inadequate protection of the web page structure, allowing a remote attacker to inject arbitrary code into a loaded web page. The username...

PT-2018-2073 · D Link · D-Link Central Wifi Manager

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: The issue exists due to the lack of protection for the web page structure in the UpdateSite function of the D-Link Central WiFi Manager. This allows a remote attacker ...

PT-2018-2074 · D Link · D-Link Central Wifi Manager

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: The issue is related to an unrestricted file upload vulnerability in the "onUploadLogPic" endpoint, which allows remote authenticated users to execute arbitrary PHP...

CVE-2018-7277

An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP...

WiFi Manager - Exported components, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application WiFi Manager published at the 'play' market has multiple vulnerabilities...