CVE-2022-43626

CVE-2022-43626 affects the D-Link DIR-1935 (version 1.03). The flaw is in the web management SetIPv4FirewallSettings handling of IPv4FirewallRule elements, where a user-supplied string isn’t properly validated before it’s used in a system call, enabling arbitrary code execution in the root contex...

D-Link DIR-820L A1 Arbitrary Command Execution

The vulnerability of D-Link DIR-820L A1 microprogrammed router software is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on behalf of the root user in the target system...

CVE-2022-43644

CVE-2022-43644 affects D-Link DIR-825 routers (version 1.0.9/EE). The vulnerability originates in the Dreambox plugin for the xupnpd service, which listens on TCP port 4044. It stems from improper validation of a user-supplied string before it is used to execute a system call, allowing network-ad...

D-Link DIR 819 A1 - Denial of Service Exploit

Exploit Title: DLink DIR 819 A1 - Denial of Service Date: 30th September, 2022 Exploit Author: @whokilleddb https://twitter.com/whokilleddb Vendor Homepage: https://www.dlink.com/en/products/dir-819-wireless-ac750-dual-band-router Version: DIR-819 Firmware Version : 1.06 Hardware Version : A1...

D-Link DIR 819 A1 Denial Of Service

Exploit Title: DLink DIR 819 A1 - Denial of Service Date: 30th September, 2022 Exploit Author: @whokilleddb https://twitter.com/whokilleddb Vendor Homepage: https://www.dlink.com/en/products/dir-819-wireless-ac750-dual-band-router Version: DIR-819 Firmware Version : 1.06 Hardware Version : A1...

D-Link DIR-819 security vulnerabilities

The D-Link DIR-819 is a wireless dual-band router from China-based AUO D-Link. A security vulnerability exists in the D-Link DIR-819 that stems from the presence of a denial of service vulnerability...

DLink DIR 819 A1 - Denial of Service

Exploit Title: DLink DIR 819 A1 - Denial of Service Date: 30th September, 2022 Exploit Author: @whokilleddb https://twitter.com/whokilleddb Vendor Homepage: https://www.dlink.com/en/products/dir-819-wireless-ac750-dual-band-router Version: DIR-819 Firmware Version : 1.06 Hardware Version : A1...

D-Link DIR-867 Command Injection Vulnerability

The D-Link DIR-867 is a wireless router from China Youxun D-Link.A command injection vulnerability exists in the D-Link DIR-867, which is caused by a command injection vulnerability in the SetVirtualServerSettings function. By sending a carefully crafted request using the LocalIPAddress parameter...

D-Link DIR-867 <= v1.30B07 Command Injection Vulnerability

D-Link DIR-867 devices are prone to acommand injection vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

D-Link DIR-820L Devices Multiple Vulnerabilities (2023 - 2025)

D-Link DIR-820L devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2023-24762

OS Command injection vulnerability in D-Link DIR-867 DIR867FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter for the SetVirtualServerSettings to HNAP1...

Command injection

OS Command injection vulnerability in D-Link DIR-867 DIR867FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter for the SetVirtualServerSettings to HNAP1...

CVE-2023-25802: Path Traversal: '/dir/../filename'

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize dir/../filename sequences, such as /etc/nginx/../passwd, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue...

CVE-2023-24762: Improper Neutralization of Special Elements used in an OS Command

OS Command injection vulnerability in D-Link DIR-867 DIR867FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter for the SetVirtualServerSettings to HNAP1...

PT-2023-1983

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 6.3.6.0 Description The issue is related to the Roxy-WI web interface for managing servers, which fails to correctly neutralize dir/../filename sequences. This allows an actor to gain information about a server. For...

CVE-2023-24762

CVE-2023-24762 affects the D-Link DIR-867 router (firmware 1.30B07) with an OS command-injection vulnerability in SetVirtualServerSettings to HNAP1. An attacker can craft LocalIPAddress to execute arbitrary commands. CVSSv3.1 base score 9.8 (CRITICAL), vectors: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

CVE-2023-24762

OS Command injection vulnerability in D-Link DIR-867 DIR867FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter for the SetVirtualServerSettings to HNAP1...

PT-2023-1795

Name of the Vulnerable Software and Affected Versions D-Link DIR-867 versions DIR 867 FW1.30B07 Description The issue is related to an OS command injection vulnerability in the SetVirtualServerSettings function of the D-Link DIR-867 router's firmware. This vulnerability allows an attacker to...

D-Link DIR-867: Operating System Command Injection Vulnerability

The D-Link DIR-867 is a wireless router from China Youxun D-Link.A command injection vulnerability exists in the D-Link DIR-867, which is caused by a command injection vulnerability in the SetVirtualServerSettings function. By sending a carefully crafted request using the LocalIPAddress parameter...

D-Link DIR-867 Rev. A <= v1.30B07 RCE Vulnerability

D-Link DIR-867 Rev. A devices are prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...