CVE-2021-21913

CVE-2021-21913 affects D-Link DIR-3040 with WiFi Smart Mesh. Talos details show an MQTT-based mesh service that is enabled by default and uses hard-coded credentials stored in a library, enabling an attacker to obtain the root password from MQTT mesh payloads. Exploitation yields information disc...

CVE-2021-21913

An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger this vulnerability...

Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router

Dave McDaniel of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered an exploitable information disclosure vulnerability in the D-LINK DIR-3040 smart WiFi mesh router that could allow an adversary to eventually turn off the device or remove other... Thi...

D-LINK DIR-3040 WiFi Smart Mesh information disclosure vulnerability

Summary An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger this vulnerability. Tested Versions D-LINK DIR-3040...

D-Link DIR-615 Buffer Overflow Vulnerability

The D-Link DIR-615 is a wireless router from D-Link, a Taiwan-based company. The security vulnerability in the D-Link DIR-615 stems from a network system or product that does not properly validate data boundaries when performing operations on memory, resulting in incorrect read and write operatio...

D-LINK DIR-3040 Trust Management Vulnerability

D-LINK DIR-3040 is a router from D-Link Taiwan, China. The WiFi Smart Mesh feature of the D-LINK DIR-3040 1.13B03 is vulnerable to information disclosure. An attacker could exploit the vulnerability with a specially crafted network request to cause command execution...

PT-2021-14836

Name of the Vulnerable Software and Affected Versions D-LINK DIR-3040 version 1.13B03 Description An information disclosure issue exists in the WiFi Smart Mesh functionality. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger...

CVE-2021-21913: Use of Hard-coded Credentials

An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger this vulnerability...

CVE-2021-24639

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgfajaxemptydir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server...

CVE-2021-24639

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgfajaxemptydir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server...

PT-2021-4897

Name of the Vulnerable Software and Affected Versions D-LINK-DIR-605 B2 Firmware version 2.01MT Description An information disclosure issue exists, allowing an attacker to obtain a user name and password by forging a post request to the "getcfg.php" page. This is due to insufficient protection of...

PT-2021-4645

Name of the Vulnerable Software and Affected Versions D-LINK-DIR-615 B2 version 2.01mt D-Link DIR-615 Q1 affected versions not specified Description An information disclosure issue exists, allowing an attacker to obtain a user name and password by forging a post request to the "/getcfg.php" page...

PT-2021-6122

Name of the Vulnerable Software and Affected Versions D-Link DIR-X1860 versions prior to v1.10WWB09 Beta Description The issue is related to a reflected cross-site-scripting attack in the web application of the D-Link DIR-X1860. This allows a remote unauthenticated attacker to execute code in the...

PT-2021-6117

Name of the Vulnerable Software and Affected Versions D-Link DIR-X1860 versions prior to v1.10WWB09 Beta Description The issue is related to a web application vulnerability in the D-Link DIR-X1860 Wi-Fi router's firmware, specifically concerning inadequate handling of HTTP requests. This can be...

PT-2021-6399

Name of the Vulnerable Software and Affected Versions D-Link DIR-X1860 versions prior to 1.03 RevA1 Description The issue is related to an information disclosure in the web interface of the affected device. It allows a remote unauthenticated attacker to send a specially crafted HTTP request to ga...

D-Link DIR-2055 HNAP incorrect comparison verification bypass vulnerability

The D-Link DIR-2055 is a router device. a security vulnerability exists in the D-Link DIR-2055 HNAP, which can be exploited by attackers to execute arbitrary code on the router...

D-Link DIR-2055 HNAP PrivateLogin incorrect authentication algorithm implements authentication bypass vulnerability

D-Link DIR-2055 is a router device. a security vulnerability exists in the D-Link DIR-2055 HNAP PrivateLogin authentication algorithm, which can be exploited by attackers to escalate privileges and execute arbitrary code in the router context...

D-Link DIR-816 Command Execution Vulnerability

D-Link DIR-816 is a wireless router from D-Link Taiwan, China.A security vulnerability exists in D-Link DIR-816A1FW101CNB04 750m11ac. The vulnerability is caused by a flaw in the handler function of the /goform/form2userconfig.cgi route. Through the use of HTTP request parameters, an attacker cou...

D-Link DIR-816 Command Execution Vulnerability (CNVD-2021-67516)

The D-Link DIR-816 is a wireless router from D-Link, Taiwan, China.The D-Link DIR-816 has a security vulnerability that could be exploited by attackers to execute arbitrary php code via the typename parameter...

(0Day) D-Link DIR-2055 HNAP PrivateLogin Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2055 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of...