CVE-2020-10216

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a systemtime.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

CVE-2020-10214

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntpsync.cgi with a sufficiently long parameter ntpserver...

CVE-2020-10215

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dnsqueryname parameter in a dnsquery.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

Command injection

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a systemtime.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

Code injection

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wpsstaenrolleepin parameter in a setstaenrolleepin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

Stack overflow

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntpsync.cgi with a sufficiently long parameter ntpserver...

CVE-2020-10214

Affected product: D-Link DIR-825 Rev.B (firmware 2.10). Vulnerability: stack-based buffer overflow in the httpd binary that can be triggered by a POST to ntp_sync.cgi with a sufficiently long ntp_server parameter. Impact: allows an authenticated user to execute arbitrary code on the device. Root ...

CVE-2020-10215

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dnsqueryname parameter in a dnsquery.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

CVE-2020-10215

The D-Link DIR-825 Rev.B 2.10 and TRENDnet TEW-632BRP 1.010B32 routers are vulnerable to a command injection flaw in the dns_query.cgi component. This vulnerability exists because the software fails to properly neutralize special elements used in operating system commands when processing the dns_...

CVE-2020-10216

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a systemtime.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

CVE-2020-10216

The CVE-2020-10216 entry documents a command-injection vulnerability affecting D-Link DIR-825 Rev.B 2.10 and TRENDnet TEW-632BRP 1.010B32. A remote attacker can exploit the vulnerability by sending a crafted date parameter in a system_time.cgi POST request to execute arbitrary commands. Impact is...

CVE-2020-10213

The CVE-2020-10213 entry documents a command-injection vulnerability affecting D-Link DIR-825 Rev.B devices running 2.10 and TRENDnet TEW-632BRP (1.010B32). The flaw allows remote attackers to execute arbitrary commands through the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST...

CVE-2020-10213

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wpsstaenrolleepin parameter in a setstaenrolleepin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

CVE-2020-10214: Out-of-bounds Write

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntpsync.cgi with a sufficiently long parameter ntpserver...

CVE-2020-10215: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dnsqueryname parameter in a dnsquery.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

CVE-2020-10213: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wpsstaenrolleepin parameter in a setstaenrolleepin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

CVE-2020-10216: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a systemtime.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

PT-2020-2772

Name of the Vulnerable Software and Affected Versions D-Link DIR-825 version 2.10 TRENDnet TEW-632BRP version 1.010B32 Description An issue exists in the dns query.cgi component of the affected devices, allowing remote attackers to execute arbitrary commands. This is possible via the dns query na...

Buffer Overflow Vulnerability in D-Link DIR-842

The D-Link DIR-842 is a 2.4GHz & 5GHz dual band router. The D-Link DIR-842 suffers from a buffer overflow vulnerability that can be exploited by an attacker to cause a program crash...

PT-2020-2771

Name of the Vulnerable Software and Affected Versions D-Link DIR-825 Rev.B version 2.10 TRENDnet TEW-632BRP version 1.010B32 Description An issue exists that allows remote attackers to execute arbitrary commands via the wps sta enrollee pin parameter in a "set sta enrollee pin.cgi" POST request...