CVE-2023-35753

CVE-2023-35753 concerns D-Link DAP-2622. The DDP Set AG profile UUID component has a stack-based buffer overflow due to improper validation of user-supplied data length, enabling remote code execution with root privileges on routers. The vulnerability is exploitable by network-adjacent attackers ...

CVE-2023-35743

CVE-2023-35743 concerns the D-Link DAP-2622 DDP service. The flaw is a stack-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying into a fixed-size stack buffer, enabling remote code execution in the context of root. The vulnerability permits ...

CVE-2023-35742 D-Link DAP-2622 DDP Configuration Restore Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP Configuration Restore Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit...

CVE-2023-35730

The CVE-2023-35730 entry concerns D-Link DAP-2622 firmware vulnerability in the DDP service. A stack-based buffer overflow caused by improper validation of user-supplied data length can allow a network-adjacent attacker with no authentication to execute arbitrary code with root privileges. Docume...

CVE-2023-35725 D-Link DAP-2622 DDP User Verification Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP User Verification Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-34281

D‑Link DIR‑2150 is affected by CVE‑2023‑34281 due to a GetFirmwareStatus target command injection in the SOAP API interface (listening on TCP/80). The flaw lacks proper validation of a user‑supplied string that is used to execute a system call, enabling an attacker to run arbitrary code with root...

CVE-2023-32145

Consolidated view of CVE-2023-32145: D-Link DAP-1360 devices are affected by a hardcoded credentials authentication bypass in the web UI login handling. This enables network-adjacent attackers to bypass authentication without user interaction. The vulnerability scores high (CVSSv3.1: AV=A, AC:L, ...

CVE-2023-42128: Improper Neutralization of Special Elements used in an OS Command

Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must...

CVE-2023-51627: Stack-based Buffer Overflow

D-Link DCS-8300LHV2 ONVIF Duration Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this...

CVE-2023-35720: Improper Neutralization of Special Elements used in an SQL Command

ASUS RT-AX92U lighttpd modwebdav.so SQL Injection Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected ASUS RT-AX92U routers. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2023-41186: Missing Authentication for Critical Function

D-Link DAP-1325 CGI Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to access various functionality on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific fl...

CVE-2023-35718: Stack-based Buffer Overflow

D-Link DAP-2622 DDP Change ID Password Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-41200: Improper Neutralization of Special Elements used in an OS Command

D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticPrefixLength Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit...

CVE-2023-34282: Incorrect Implementation of Authentication Algorithm

D-Link DIR-2150 HNAP Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this...

CVE-2023-41195: Improper Neutralization of Special Elements used in an OS Command

D-Link DAP-1325 HNAP SetHostIPv6Settings IPv6Mode Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerabilit...

CVE-2023-44406: Stack-based Buffer Overflow

D-Link DAP-1325 SetAPLanSettings DeviceName Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this...

CVE-2023-50224: Authentication Bypass by Spoofing

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability...

CVE-2023-50212: Improper Handling of Exceptional Conditions

D-Link G416 httpd Improper Handling of Exceptional Conditions Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability...

CVE-2024-32051

The RoamWiFi R10 portable Internet wireless router is vulnerable to an issue where sensitive information is inserted into log files (CWE-532, CWE-200). This flaw affects versions prior to 4.8.45 . A network-adjacent unauthenticated attacker with access to the device can exploit this to obtain sen...

CVE-2024-30220

Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port. Note that MZK-MF300N is no longer supported, therefore the update for this...