CVE-2019-7297: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7236

An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal...

PT-2019-18477

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.13 Description An issue was discovered in idreamsoft iCMS, where the editor/editor.admincp.php file allows directory traversal via the dir parameter in the "app=editor&do=fileManager" API endpoint. Recommendations F...

The vulnerability of the soapcgi_main function in the soap.cgi script of D-Link DIR-818LW and DIR-860L routers allows a hacker to execute arbitrary commands on the operating system.

The vulnerability of the soapcgimain function in the soap.cgi script /htdocs/cgibin/soap.cgi of the D-Link DIR-818LW and DIR-860L router software is caused by privilege management errors. Exploiting this vulnerability allows an attacker to execute arbitrary operating system commands using the...

Command Execution Vulnerability in Multiple D-Link Products

D-Link DIR-822 C1 and others are wireless router products from AUO D-Link. A command execution vulnerability exists in multiple D-Link products, which can be exploited by remote attackers to execute commands...

The vulnerability of D-Link DIR-620 router’s microprogramming software, which stems from the use of pre-installed registration data, allows attackers to enhance their privileges and execute arbitrary code.

The vulnerability of D-Link DIR-620 router microprogramming software is related to the use of pre-installed registration data. Exploiting this vulnerability allows a remote attacker to enhance their privileges and execute arbitrary code...

The vulnerability of the /goform/form2userconfig.cgi component in D-Link DIR-816 router software allows a hacker to execute arbitrary code.

The vulnerability of the /goform/form2userconfig.cgi component in D-Link DIR-816 router microprogramming software is caused by an overflow in the stack buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2018-20674

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authenticated remote command execution...

CVE-2018-20675

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authentication bypass...

CVE-2018-20674

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authenticated remote command execution...

Authentication flaw

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authentication bypass...

CVE-2018-20674

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authenticated remote command execution...

CVE-2018-20674

The vulnerability CVE-2018-20674 affects multiple D-Link wireless routers (DIR-822 C1/US C1, DIR-850L A*/B*, DIR-880L A*) prior to specific Beta firmware versions (e.g., v3.11B01Beta for DIR-822/US; v1.21B08Beta for DIR-850L A*, v2.22B03Beta for DIR-850L B*, v1.20B02Beta for DIR-880L A*). It enab...

CVE-2018-20674: Undefined Security Weakness

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authenticated remote command execution...

CVE-2018-20675: Improper Authentication

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authentication bypass...

PT-2019-20261

Name of the Vulnerable Software and Affected Versions D-Link DIR-822 versions Rev.B through Rev.C D-Link DIR-860L version Rev.B D-Link DIR-868L version Rev.B D-Link DIR-880L version Rev.A D-Link DIR-890L version Rev.A D-Link DIR-818LW version Rev.A D-Link DIR-822 version B1 Description The issue...

PT-2019-6335 · D Link · D-Link Dir-822

Name of the Vulnerable Software and Affected Versions: D-Link DIR-822 versions Rev.B 202KRb06 through Rev.C 3.10B06 Description: The issue is related to insufficient regular expression checking in the SetQoSSettings.php script of D-Link DIR-822 routers when handling the uplink parameter. This can...

PT-2019-6336 · D Link · D-Link Dir-822

Name of the Vulnerable Software and Affected Versions: D-Link DIR-822 B1 version 202KRb06 Description: The issue is related to insufficient checking of arguments passed to a command when handling the WPSPIN parameter in the SetWiFiVerifyAlpha.php script. This could allow a remote attacker to impa...

CVE-2018-20114

On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cgibin binary via an "&&" substring in the service parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-6530...

CVE-2018-20114

On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cgibin binary via an "&&" substring in the service parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-6530...