CVE-2018-8917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in info.cgi in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter...

PT-2018-18716

Name of the Vulnerable Software and Affected Versions Synology Router Manager SRM versions prior to 1.1.7-6941 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the host parameter in the info.cgi file...

CVE-2018-18441: Exposure of Sensitive Information to an Unauthorized Actor

D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many mor...

PT-2018-3942

Name of the Vulnerable Software and Affected Versions D-Link DCS series Wi-Fi cameras versions 1.00 and above Description The issue is related to insufficient protection of registration data in the common/info.cgi component of D-Link DCS series Wi-Fi cameras' firmware. This can allow a remote...

CVE-2014-125117

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlinkdspw215infocgibof.rb 2025-10-23 21:12:57+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:48:30+00:00| seen|...

Authentication flaw

An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access administrative settings and obtain cleartext credentials from HTML source, as demonstrated by info.cgi, upload.cgi, backupsettings.cgi, pppoe.cgi,...

PT-2017-13320

Name of the Vulnerable Software and Affected Versions iBall Baton ADSL2+ Home Router version FW iB-LR7011A 1.0.2 Description The issue allows attackers to bypass authentication and access administrative router settings by crafting URLs with a .cgi extension, such as "/info.cgi" and "/password.cgi...

CVE-2017-14244: Direct Request

An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FWiB-LR7011A1.0.2 devices potentially allows attackers to directly access administrative router settings by crafting URLs with a .cgi extension, as demonstrated by /info.cgi and /password.cgi...

CVE-2017-14243: Improper Authentication

An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access administrative settings and obtain cleartext credentials from HTML source, as demonstrated by info.cgi, upload.cgi, backupsettings.cgi, pppoe.cgi,...

PT-2017-13319

Name of the Vulnerable Software and Affected Versions UTStar WA3002G4 ADSL Broadband Modem version WA3002G4-0021.01 Description The issue allows attackers to bypass authentication and directly access administrative settings. Attackers can obtain cleartext credentials from the HTML source of vario...

D-Link DSP-W215 (info.cgi) POST Request Buffer Overflow Exploit

This Metasploit module exploits an anonymous remote code execution vulnerability on different D-Link devices. The vulnerability is an stack based buffer overflow in the mycgi.cgi component, when handling specially crafted POST HTTP requests addresses to the /common/info.cgi handler. This Metasplo...

D-Link info.cgi POST Request Buffer Overflow

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'D-Link info.cgi POST Request Buffer Overflow', 'Description' = %q This module exploits an anonymous remote code execution vulnerabili...

Synology DiskStation Manager < 4.3-3776 Update 3 info.cgi Multiple Parameters XSS

According to its version number, the Synology DiskStation Manager installed on the remote host is a version prior to 4.3-3776 Update 3. It is, therefore, potentially affected by a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the 'host', 'target'...