CVE-2021-46452

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via the tomographypingaddress, tomographypingnumber, tomographypingsize,...

CVE-2021-46226

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

CVE-2021-46232

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function versionupgrade.asp. This vulnerability allows attackers to execute arbitrary commands via the path parameter...

CVE-2021-46229

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usbpaswd.asp. This vulnerability allows attackers to execute arbitrary commands via the name parameter...

Command injection

D-Link device DIR882 DIR882FW1.30B06Hotfix02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request...

Command injection

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function versionupgrade.asp. This vulnerability allows attackers to execute arbitrary commands via the path parameter...

Command injection

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpddebug.asp. This vulnerability allows attackers to execute arbitrary commands via the time parameter...

CVE-2021-46230

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgradefilter. This vulnerability allows attackers to execute arbitrary commands via the path and time parameters...

CVE-2021-46452

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via the tomographypingaddress, tomographypingnumber, tomographypingsize,...

The vulnerability of the webproc getpage implementation in the microprogramming software for wireless access points from D-Link, DAP-2020, allows a intruder to execute arbitrary code.

The vulnerability of the webproc getpage implementation in the microprogrammed wireless access points from D-Link, such as the DAP-2020, is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2021-40284

D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service. This vulnerability exists in the web interface "/cgi-bin/NewGUI/Igmp.asp". Authenticated remote attackers can trigger this vulnerability by sending a long string in parameter 'igmpsnoopEnable'...

TP-Link TL-WPA4220 信息泄露漏洞

Tp-link TP-Link TL-WPA4220 is a home wireless WiFi bridge that extends wireless signals from China's Tp-link. The device can transmit data at high speed over the line to extend the network to areas that are currently not covered. The TP-Link TL-WPA4220 suffers from an information disclosure...

CVE-2021-28144

prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely...

CVE-2020-15894

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by...

Code injection

D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator...

CVE-2019-18666

An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested...

CVE-2020-9277

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

CVE-2020-6765

D-Link DSL-GS225 J1 AU1.0.4 devices allow an admin to execute OS commands by placing shell metacharacters after a supported CLI command, as demonstrated by ping -c1 127.0.0.1; cat/etc/passwd. The CLI is reachable by TELNET...

CVE-2019-15655

D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext...

CVE-2019-20499

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=configrestore configRestore or configServerip parameter...