CVE-2019-7388

An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get sensitive information such as MAC address about all clients in the WLAN via the GetClientInfo HNAP API. Consequently, an attacker can achiev...

CVE-2019-7389

An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to reset the router without authentication via the SetFactoryDefault HNAP API. Consequently, an attacker can achieve a denial-of-service attack...

CVE-2019-7390

The CVE-2019-7390 issue affects D-Link DIR-823G devices with firmware 1.02B03. A flawed access control in /bin/goahead permits remote attackers to hijack the WLAN DNS service configuration via the SetWanSettings HNAP API without authentication, potentially impacting all clients on the WLAN. Docum...

CVE-2019-7298

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

CVE-2019-7298

Summary: CVE-2019-7298 affects the D-Link DIR-823G family (firmware up to 1.02B03). The vulnerability is an OS command injection in HNAP processing: any HNAP API function can trigger a call to the system() function using untrusted input from the request body, enabling remote command execution. An...