CVE-2019-7298

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

CVE-2019-7298

Summary: CVE-2019-7298 affects the D-Link DIR-823G family (firmware up to 1.02B03). The vulnerability is an OS command injection in HNAP processing: any HNAP API function can trigger a call to the system() function using untrusted input from the request body, enabling remote command execution. An...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

Command injection

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

CVE-2019-7297 affects D-Link DIR-823G devices with firmware up to 1.02B03. A command-injection vulnerability exists in the /HNAP1 interface: GetNetworkTomographyResult calls system with an untrusted Address input, allowing remote attackers to execute arbitrary OS commands via crafted requests. Ex...

CVE-2018-19040

The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

CVE-2018-19041

The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

PT-2019-1345 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G devices with firmware through 1.02B03 Description: An issue allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls...

The vulnerability of the soapcgi_main function in the soap.cgi script of D-Link DIR-818LW and DIR-860L routers allows a hacker to execute arbitrary commands on the operating system.

The vulnerability of the soapcgimain function in the soap.cgi script /htdocs/cgibin/soap.cgi of the D-Link DIR-818LW and DIR-860L router software is caused by privilege management errors. Exploiting this vulnerability allows an attacker to execute arbitrary operating system commands using the...

Command Execution Vulnerability in Multiple D-Link Products

D-Link DIR-822 C1 and others are wireless router products from AUO D-Link. A command execution vulnerability exists in multiple D-Link products, which can be exploited by remote attackers to execute commands...

The vulnerability of D-Link DIR-620 router’s microprogramming software, which stems from the use of pre-installed registration data, allows attackers to enhance their privileges and execute arbitrary code.

The vulnerability of D-Link DIR-620 router microprogramming software is related to the use of pre-installed registration data. Exploiting this vulnerability allows a remote attacker to enhance their privileges and execute arbitrary code...

The vulnerability of the /goform/form2userconfig.cgi component in D-Link DIR-816 router software allows a hacker to execute arbitrary code.

The vulnerability of the /goform/form2userconfig.cgi component in D-Link DIR-816 router microprogramming software is caused by an overflow in the stack buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2018-20675

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authentication bypass...

CVE-2018-20674

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authenticated remote command execution...

CVE-2018-20674

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authenticated remote command execution...

Authentication flaw

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authentication bypass...

CVE-2018-20674

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A before v1.21B08Beta, DIR-850L B before v2.22B03Beta, and DIR-880L A before v1.20B02Beta devices allow authenticated remote command execution...

CVE-2018-20674

The vulnerability CVE-2018-20674 affects multiple D-Link wireless routers (DIR-822 C1/US C1, DIR-850L A*/B*, DIR-880L A*) prior to specific Beta firmware versions (e.g., v3.11B01Beta for DIR-822/US; v1.21B08Beta for DIR-850L A*, v2.22B03Beta for DIR-850L B*, v1.20B02Beta for DIR-880L A*). It enab...