CVE-2013-7051

CVE-2013-7051 affects D-Link DIR-100 with firmware 4.03B07. The issue is a security bypass in the cli.cgi module caused by failure to check authentication parameters, enabling unauthorized access through the CLI path. Public references describe multiple vulnerabilities for this device (CVE-2013-7...

CVE-2013-7051

D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters...

D-Link DIR-859 ssdpcgi() M-SEARCH arbitrary command execution vulnerability (CNVD-2020-13686)

The D-Link DIR-859 is a router device. A security vulnerability exists in the D-Link DIR-859 ssdpcgi M-SEARCH method of handling, which can be exploited by remote attackers to submit a special request to execute arbitrary commands...

PT-2020-7566 · D Link · D-Link Dir-100

Name of the Vulnerable Software and Affected Versions: D-Link DIR-100 version 4.03B07 Description: The issue concerns a CSRF vulnerability in the cli.cgi endpoint. Recommendations: For D-Link DIR-100 version 4.03B07, consider restricting access to the cli.cgi endpoint as a temporary workaround...

PT-2020-7565 · D Link · D-Link Dir-100

Name of the Vulnerable Software and Affected Versions: D-Link DIR-100 version 4.03B07 Description: The issue is related to a security bypass due to an error in the cliget.cgi script. Recommendations: For D-Link DIR-100 version 4.03B07, consider restricting access to the cliget.cgi script as a...

PT-2020-7567 · D Link · D-Link Dir-100

Name of the Vulnerable Software and Affected Versions: D-Link DIR-100 version 4.03B07 Description: The issue is related to an XSS vulnerability in the cli.cgi module. Recommendations: For D-Link DIR-100 version 4.03B07, update to a newer version that contains a fix for this issue...

D-Link DIR-859 ssdpcgi() M-SEARCH arbitrary command execution vulnerability (CNVD-2020-13689)

The D-Link DIR-859 is a router device. A security vulnerability exists in the D-Link DIR-859 ssdpcgi M-SEARCH method handling, which can be exploited by remote attackers to submit a special request to execute arbitrary commands...

PT-2020-7568 · D Link · D-Link Dir-100

Name of the Vulnerable Software and Affected Versions: D-Link DIR-100 version 4.03B07 Description: The issue concerns information disclosure related to PPTP and PoE on the affected device. Recommendations: For D-Link DIR-100 version 4.03B07, update to a newer version that addresses the informatio...

PT-2020-7564 · D Link · D-Link Dir-100

Name of the Vulnerable Software and Affected Versions: D-Link DIR-100 version 4.03B07 Description: The issue is related to a security bypass in the cli.cgi module due to a failure to check authentication parameters. Recommendations: For D-Link DIR-100 version 4.03B07, consider restricting access ...

CVE-2019-20215

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because HTTPST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker t...

CVE-2019-20217

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because SERVERID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attack...

CVE-2019-20217

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because SERVERID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attack...

CVE-2019-20216

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because REMOTEPORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an...

CVE-2019-20215

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because HTTPST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker t...

Design/Logic Flaw

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because SERVERID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attack...

Design/Logic Flaw

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because REMOTEPORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an...

Design/Logic Flaw

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because HTTPST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker t...

CVE-2019-20217

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because SERVERID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attack...

CVE-2019-20217

Affected product: D-Link DIR-859 router (firmware 1.05 and 1.06B01 Beta01). Vulnerabilities concern the ssdpcgi() M-SEARCH handling in /htdocs/cgibin, where the urn: service/device value is parsed with strstr, enabling an attacker to append shell metacharacters and execute arbitrary OS commands. ...

CVE-2019-20216

CVE-2019-20216 affects D-Link DIR-859 routers (versions 1.05 and 1.06B01 Beta01). The flaw resides in ssdpcgi() handling of M-SEARCH requests and is triggered by the urn: to the M-SEARCH path, with REMOTE_PORT mishandled. The urn: service/device value is checked with strstr, enabling an attacker ...