CVE-2021-26709

The CVE-2021-26709 entry concerns D-Link DSL-320B-D1 devices (EU_1.25 and earlier) with a stack-based buffer overflow in the device firmware that allows unauthenticated remote attackers to takeover the device via login.xgi. Affected product: D-Link DSL-320B-D1; vulnerability type: multiple pre-au...

CVE-2021-26709

D-Link DSL-320B-D1 devices through EU1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device via the login.xgi user and pass parameters. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

D-Link DSL-320B-D1 缓冲区错误漏洞

The D-Link DSL?320B is an Ethernet modem from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the D-Link DSL-320B-D1 device EU1.25 version and earlier versions, which allows an unauthenticated, remote attacker to take over the device via login...

TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated)

Exploit Title: TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting Unauthenticated Date: 24-07-2020 Exploit Author: Smriti Gaba, Kaustubh Padwad Vendor Homepage: https://www.tp-link.com Version: Multiple ============================================================== Unauthenticated...

Weak Password Vulnerability in DSL-2730E of AUO Electronic Equipment (Shanghai) Co.

DSL-2730E is a routing device of AUO Electronic Equipment Shanghai Co. A weak password vulnerability exists in the AUO Electronic Devices Shanghai Co. DSL-2730E, which can be exploited by attackers to obtain sensitive information...

TP-Link Devices - (setDefaultHostname) Stored Cross-site Scripting Vulnerability

Multiple TP-Link devices suffer from an unauthenticated persistent cross site scripting vulnerability. Affected models include TD-W9977, TL-WA801ND, TL-WA801N, TL-WR802N, and Archer-C3150. ============================================================== Unauthenticated Stored Cross-site Scripting i...

The vulnerability of the web portal of D-Link DSL-2888A microprogramming software for routers allows a hacker to exploit it to increase their privileges.

The vulnerability of the D-Link DSL-2888A router’s microprogramming software web portal is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

The vulnerability of D-Link DSL-2888A router microprogramming software, related to deficiencies in authentication procedures, allows attackers to carry out IP spoofing attacks.

The vulnerability of D-Link DSL-2888A router’s microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a remote attacker to carry out IP spoofing attacks...

PT-2021-2654 · D Link · D-Link Dsl-320B-D1

Name of the Vulnerable Software and Affected Versions: D-Link DSL-320B-D1 devices through EU 1.25 Description: The issue is related to a buffer overflow in the device's firmware, allowing a remote attacker to gain unauthorized access to the device with user login.xgi privileges. The vulnerability...

CVE-2020-27863

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 80...

CVE-2020-27862

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by...

CVE-2020-27863

CVE-2020-27863 affects D-Link DVA-2800 and DSL-2888A routers. The flaw is in the dhttpd service (listening on TCP port 8008 by default) where incorrect string-matching logic when accessing protected pages allows network-adjacent attackers to disclose stored credentials without authentication. The...

CVE-2020-27862

CVE-2020-27862 affects D-Link DVA-2800 and DSL-2888A routers. A flaw in the dhttpd service handling of the path parameter allows an unauthenticated, network-adjacent attacker to execute arbitrary code via a system call, with impact on the web server context. The issue is triggered by parsing the ...

D-Link DVA-2800 and DSL-2888A License Issue Vulnerability

The D-Link DVA-2800 and DSL-2888A is a wireless router from D-Link. It provides the ability to connect to a network. An authorization issue vulnerability exists in D-Link DVA-2800 and DSL-2888A firmware version 2.3, which can be exploited by an attacker to disclose stored credentials, leading to...

D-Link DVA-2800 and DSL-2888A 命令注入漏洞

The D-link DSL-2888A is a Unified Services Router from China AUO D-link. A command injection vulnerability exists in the D-Link DVA-2800 and DSL-2888A firmware, which arises from a network system or product that does not properly filter specific elements of externally inputted data during the...

ASUS DSL-N14U-B1 code issue vulnerability

ASUS DSL-N14U-B1 is a router device from ASUS China. ASUS DSL-N14U-B1 1.1.2.3805 devices is vulnerable and can be exploited by attackers to upload arbitrary file content as a firmware update...

CVE-2021-3166

An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3805 devices. An attacker can upload arbitrary file content as a firmware update when the filename SettingsDSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update,...

CVE-2021-3166

An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3805 devices. An attacker can upload arbitrary file content as a firmware update when the filename SettingsDSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update,...

CVE-2021-3166

An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3805 devices. An attacker can upload arbitrary file content as a firmware update when the filename SettingsDSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update,...

Code injection

An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3805 devices. An attacker can upload arbitrary file content as a firmware update when the filename SettingsDSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update,...