CVE-2019-14337

CVE-2019-14337 affects D-Link 6600-AP and DWL-3600AP devices running firmware 4.2.0.14 (Ax). The issue enables escaping the restricted command-line interface to a shell, demonstrated by the /bin/sh -c wget sequence. Documented references include NVD (CVSS2/3.1), Red Hat and CNVD entries, and thir...

CVE-2019-14336

CVE-2019-14336 affects D-Link 6600-AP and DWL-3600AP with firmware 4.2.0.14 Ax. The vulnerability enables post-authenticated dump of all configuration files via an insecure HTTP request to admin.cgi, leading to information disclosure. Multiple connected sources corroborate an authenticated access...

CVE-2019-14334

The CVE-2019-14334 issue affects D-Link 6600-AP, DWL-3600AP, and DWL-8610AP devices running firmware 4.2.0.14 (Ax, dated 21/03/2019). A post-authenticated vulnerability exists in the sslcert-get.cgi HTTP command that allows extraction of the device certificate and RSA private key. This constitute...

CVE-2019-14332

CVE-2019-14332 affects D-Link 6600-AP and DWL-3600AP (Ax 4.2.0.14). The issue is the use of weak SSH ciphers (e.g., diffie-hellman-group1-sha1) in affected firmware. Evidence in multiple sources confirms the vulnerability details and affected devices; some sources also reference related SSH brute...

PT-2019-13618

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue allows for a post-authenticated dump of all configuration files through a certain "admin.cgi?action=" insecure HTTP request. Recommendations For D-Link 6600-AP and DWL-3600...

CVE-2019-14333: Undefined Security Weakness

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service attack against the access point via a long action parameter to admin.cgi...

CVE-2019-14337: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command line interface, as demonstrated by the /bin/sh -c wget sequence...

CVE-2019-14336: Undefined Security Weakness

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request...

D-Link 6600-AP XSS / DoS / Information Disclosure Vulnerabilities

Exploit for hardware platform in category web applications Security Advisory - 22/07/2019 Multiple vulnerabilities found in the D-Link 6600-AP device running the latest firmware version 4.2.0.14. D-Link 6600-AP is not produced anymore but the support is still provided by D-Link as per described o...

PT-2019-13620

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered on the management interface of the affected devices, where a post-authentication XSS vulnerability exists in the "admin.cgi?action=" API endpoint...

PT-2019-13619

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered that allows escaping to a shell in the restricted command line interface. This can be achieved by using the sequence /bin/sh -c wget. Recommendations For...

PT-2019-13615

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered that allows a pre-authenticated denial of service attack against the access point. This can be achieved via a long action parameter to the "admin.cgi"...

CVE-2019-14332: Inadequate Encryption Strength

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is use of weak ciphers for SSH such as diffie-hellman-group1-sha1...

CVE-2019-14338: Improper Neutralization of Input During Web Page Generation

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

CVE-2019-14334: Improper Certificate Validation

An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private Key extraction through an insecure sslcert-get.cgi HTTP command...

PT-2019-13614

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered where weak ciphers are used for SSH, such as diffie-hellman-group1-sha1. Recommendations For D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14, consider...

PT-2019-13616

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP version 4.2.0.14 D-Link DWL-3600AP version 4.2.0.14 D-Link DWL-8610AP Ax version 4.2.0.14 Description An issue was discovered that allows post-authenticated Certificate and RSA Private Key extraction through an insecure...

D-Link 6600-AP XSS / DoS / Information Disclosure

Security Advisory - 22/07/2019 Multiple vulnerabilities found in the D-Link 6600-AP device running the latest firmware version 4.2.0.14. D-Link 6600-AP is not produced anymore but the support is still provided by D-Link as per described on the D-Link website. Not that this product is built for...

Cisco IOS Access Points Software Input Validation Error Vulnerability

Cisco IOS Access Points APs Software is a set of software from Cisco USA dedicated to Cisco wireless access point devices. An input validation error vulnerability exists in the implementation of 802.11r Fast Transition in Cisco IOS APs Software. An attacker could exploit this vulnerability to cau...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...