CVE-2023-35742 D-Link DAP-2622 DDP Configuration Restore Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP Configuration Restore Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit...

CVE-2023-35730

The CVE-2023-35730 entry concerns D-Link DAP-2622 firmware vulnerability in the DDP service. A stack-based buffer overflow caused by improper validation of user-supplied data length can allow a network-adjacent attacker with no authentication to execute arbitrary code with root privileges. Docume...

CVE-2023-35725 D-Link DAP-2622 DDP User Verification Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP User Verification Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-34281

D‑Link DIR‑2150 is affected by CVE‑2023‑34281 due to a GetFirmwareStatus target command injection in the SOAP API interface (listening on TCP/80). The flaw lacks proper validation of a user‑supplied string that is used to execute a system call, enabling an attacker to run arbitrary code with root...

CVE-2023-32145

Consolidated view of CVE-2023-32145: D-Link DAP-1360 devices are affected by a hardcoded credentials authentication bypass in the web UI login handling. This enables network-adjacent attackers to bypass authentication without user interaction. The vulnerability scores high (CVSSv3.1: AV=A, AC:L, ...

CVE-2023-50212: Improper Handling of Exceptional Conditions

D-Link G416 httpd Improper Handling of Exceptional Conditions Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability...

CVE-2023-42128: Improper Neutralization of Special Elements used in an OS Command

Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must...

CVE-2023-41200: Improper Neutralization of Special Elements used in an OS Command

D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticPrefixLength Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit...

CVE-2023-41195: Improper Neutralization of Special Elements used in an OS Command

D-Link DAP-1325 HNAP SetHostIPv6Settings IPv6Mode Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerabilit...

CVE-2023-44406: Stack-based Buffer Overflow

D-Link DAP-1325 SetAPLanSettings DeviceName Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this...

CVE-2023-34282: Incorrect Implementation of Authentication Algorithm

D-Link DIR-2150 HNAP Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this...

CVE-2023-50224: Authentication Bypass by Spoofing

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability...

CVE-2023-51627: Stack-based Buffer Overflow

D-Link DCS-8300LHV2 ONVIF Duration Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this...

CVE-2023-35718: Stack-based Buffer Overflow

D-Link DAP-2622 DDP Change ID Password Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-35720: Improper Neutralization of Special Elements used in an SQL Command

ASUS RT-AX92U lighttpd modwebdav.so SQL Injection Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected ASUS RT-AX92U routers. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2023-41186: Missing Authentication for Critical Function

D-Link DAP-1325 CGI Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to access various functionality on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific fl...

CVE-2024-32051

The RoamWiFi R10 portable Internet wireless router is vulnerable to an issue where sensitive information is inserted into log files (CWE-532, CWE-200). This flaw affects versions prior to 4.8.45 . A network-adjacent unauthenticated attacker with access to the device can exploit this to obtain sen...

CVE-2024-30220

Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port. Note that MZK-MF300N is no longer supported, therefore the update for this...

CVE-2024-30381

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices. The...

CVE-2024-25579

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B"...