Command injection

On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable...

CVE-2019-17507

An issue was discovered on D-Link DIR-816 A1 1.06 devices. An attacker could access management pages of the router via a client that ignores the 'top.location.href = "/dirlogin.asp"' line in a .asp file. This provides access to dstatus.asp, version.asp, ddhcptbl.asp, and dacl.asp...

CVE-2019-17507

CVE-2019-17507 affects D-Link DIR-816 A1 devices (1.06). The issue is an authentication/bypass flaw allowing a client that ignores a redirect in dir_login.asp to access management pages (d_status.asp, version.asp, d_dhcptbl.asp, d_acl.asp). Root cause: bypasses the login/authorization mechanism v...

CVE-2019-17508

On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable...

CVE-2019-17508

The CVE-2019-17508 entry covers command-injection on D-Link DIR-859 (A3-1.06) and DIR-850 (A1.13) devices via /etc/services/DEVICE.TIME.php, exploitable through the $SERVER variable. Multiple connected documents corroborate a remote-code-execution risk with high impact: CVSS v3.1 base score 9.8 (...

CVE-2019-17509

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php...

CVE-2019-17509

CVE-2019-17509 affects D-Link DIR-846 devices with firmware 100A35. Remote attackers with admin access can execute arbitrary OS commands as root by sending a crafted /HNAP1/ SetMasterWLanSettings request to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php using shell metacharacters. The...

CVE-2019-17510

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php...

CVE-2019-17510

CVE-2019-17510 affects D-Link DIR-846 devices running firmware 100A35, allowing remote attackers with admin access to execute arbitrary OS commands as root via a /HNAP1/ SetWizardConfig.php request using shell metacharacters. The issue targets the SetWizardConfig path under /squashfs-root/www/HNA...

PT-2019-4070 · D Link · D-Link Dir-868L +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L version B1-2.03 D-Link DIR-817LW version A1-1.04 Description: The issue is related to a lack of authentication requirements in the web interfaces of the affected routers. An attacker can exploit this by using the DEVICE.ACCOUN...

PT-2019-4069

Name of the Vulnerable Software and Affected Versions D-Link DIR-859 versions A3 D-Link DIR-850L version A1.13 Description The issue is related to the etc/services/DEVICE.TIME.php component of the D-Link DIR-859 A3 and D-Link DIR-850L A microprogrammed software for wireless routers. It is...

PT-2019-4068

Name of the Vulnerable Software and Affected Versions D-Link DIR-816 A1 version 1.06 Description An issue allows an attacker to access management pages of the router by ignoring a specific line in an .asp file, providing access to sensitive pages such as d status.asp, version.asp, d dhcptbl.asp,...

PT-2019-5815

Name of the Vulnerable Software and Affected Versions D-Link DIR-846 version 100A35 Description The issue is related to insufficient argument checking in the SetWizardConfig function of the D-Link DIR-846 firmware, allowing remote attackers to execute arbitrary OS commands as root. This can be...

CVE-2019-17506: Missing Authentication for Critical Function

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password and other information via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZEDGROUP=1%0a to getcfg.php...

CVE-2019-17507: Improper Input Validation

An issue was discovered on D-Link DIR-816 A1 1.06 devices. An attacker could access management pages of the router via a client that ignores the 'top.location.href = "/dirlogin.asp"' line in a .asp file. This provides access to dstatus.asp, version.asp, ddhcptbl.asp, and dacl.asp...

CVE-2019-17508: Improper Neutralization of Special Elements used in an OS Command

On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable...

CVE-2019-17509: Improper Neutralization of Special Elements used in an OS Command

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php...

CVE-2019-17510: Improper Neutralization of Special Elements used in an OS Command

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php...

CVE-2019-17353

An issue discovered on D-Link DIR-615 devices with firmware version 20.05 and 20.07. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page...

CVE-2019-17353

An issue discovered on D-Link DIR-615 devices with firmware version 20.05 and 20.07. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page...