D-Link DIR Devices Information Disclosure Vulnerability (Oct 2019)

Multiple D-Link DIR devices are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

D-Link DIR-817LW and D-Link DIR-868L License Issue Vulnerability

The D-Link DIR-817LW and the D-Link DIR-868L are both wireless routers from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-868L version B1-2.03 and the DIR-817LW version A1-1.04, which stems from the fact that some web interfaces do not require authentication. The...

Multiple D-Link routers vulnerable to remote command execution

Overview Multiple D-Link routers are vulnerable to unauthenticated remote command execution. Description Several D-Link routers contain CGI capability that is exposed to users as /applysec.cgi, and dispatched on the device by the binary /www/cgi/ssi. This CGI code contains two flaws: 1. The...

D-Link DIR-866L Cross-Site Scripting Vulnerability

The D-Link DIR-866L is a wireless router from AUO D-Link of Taiwan, China. A cross-site scripting vulnerability exists in the D-Link DIR-866L version 1.03B04. A remote attacker can exploit this vulnerability to execute arbitrary code via the device's common gateway interface...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17512

CVE-2019-17512 affects D-Link DIR-412 devices (A1-1.14WW). The issue arises from web interfaces that allow unauthenticated users to clear the router’s log by invoking log_clear.php with act=clear&logtype=sysact, which could erase attack traces. The NVD entry notes a base score of 6.4 (CVSS2) and ...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

Design/Logic Flaw

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

The CVE-2019-17663 entries describe a cross-site scripting vulnerability in D-Link DIR-866L firmware (version 1.03B04) where HtmlResponseMessage in the device’s common gateway interface can be abused to perform a common injection. Root cause centers on how input data is processed by HtmlResponseM...

D-Link DIR-880L and DIR-895 L/R Buffer Overflow Vulnerability

The D-Link DIR-880L is a wireless AC1900 dual-band Gigabit cloud router.The D-Link DIR-895 L/R is an AC5300 Wi-Fi tri-band router. A buffer overflow vulnerability exists in the htdocs/fileaccess.cgi component in the D-Link DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. An attacker can exploit this...

CVE-2017-14948

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

Buffer overflow

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

CVE-2017-14948

The CVE-2017-14948 issue affects D-Link DIR-880L (1.08B04) and DIR-895 L/R (1.13b03) due to a buffer overflow in the htdocs/fileaccess.cgi component. A crafted HTTP request where CONTENT_TYPE begins with boundary= and exceeds 256 characters can trigger a buffer overflow, potentially enabling remo...

CVE-2017-14948

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

CVE-2019-17511

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via logget.php, which could be used to discover the intranet network structure...

Authentication flaw

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via logget.php, which could be used to discover the intranet network structure...