CVE-2018-19990

In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pi...

CVE-2018-19990

CVE-2018-19990 concerns D-Link DIR-822 B1 202KRb06 where /HNAP1/SetWiFiVerifyAlpha processes WPSPIN in XML and stores it in internal memory without input validation; the do_wps path uses that value with an insecure wpatalk flow. Public references also tag related issues (e.g., CVE-2018-19986) in ...

CVE-2018-19989

In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 devices. In the SetQoSSettings.php source code, the uplink parameter is saved in the /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth...

CVE-2018-19988

CVE-2018-19988 affects D-Link DIR-868L Rev.B 2.05B02. In /HNAP1/SetClientInfoDemo, AudioMute/AudioEnable are saved in the ShellPath script without regex validation, and after file execution a command-injection can occur. The vulnerability can be triggered by a crafted XML message containing singl...

CVE-2018-19987

CVE-2018-19987 affects multiple D-Link devices (DIR-822 Rev.B/Rev.C, DIR-860L Rev.B, DIR-868L Rev.B, DIR-880L Rev.A, DIR-890L Rev.A). The vulnerability is in /HNAP1/SetAccessPointMode and is caused by how the IsAccessPoint parameter is handled in SetAccessPointMode.php: it is saved to the ShellPa...

CVE-2018-19986

In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 devices. In the SetRouterSettings.php source code, the RemotePort parameter is saved in the $pathinfwan1."/web" internal...

CVE-2019-11418

apply.cgi on the TRENDnet TEW-632BRP 1.010B32 router has a buffer overflow via long strings to the SOAPACTION:HNAP1 interface...

CVE-2019-11418

CVE-2019-11418 affects the TRENDnet TEW-632BRP router (firmware around 1.010B32) and describes a buffer overflow in apply.cgi triggered by long strings sent to the SOAPACTION:HNAP1 interface. Multiple connected records corroborate the affected product and vulnerability pattern; no explicit exploi...

CVE-2019-9119

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

Command injection

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

CVE-2019-9124

An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password...

CVE-2019-9124

An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password...

Default credentials

An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password...

CVE-2019-9124

The CVE-2019-9124 entry affects D-Link DIR-878 (firmware 1.12B01). A vulnerability at the /HNAP1 URI allows login with a blank password due to weaknesses in HNAP1 authentication. This enables network-accessible (remote) compromise of confidentiality, integrity, and availability. Several sources c...

CVE-2019-9124

An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password...

D-Link DIR-878 Empty Password Login Vulnerability

The D-Link DIR-878 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the /HNAP1 URI in the D-Link DIR-878 version 1.12B01. The vulnerability can be exploited by an attacker to log in to the device with the help of an empty password...

The vulnerability of the GetNetworkTomographyResult function in the microprogramming software of the D–Link DIR-823G router allows a hacker to execute arbitrary commands on the operating system.

The vulnerability of the GetNetworkTomographyResult function in the microprogramming software of the D–Link DIR-823G router is related to insufficient cleaning of input data used in commands. Exploiting this vulnerability can allow an attacker to execute arbitrary operating system commands by...

CVE-2019-8314

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

Command injection

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

Command injection

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...