CVE-2023-44419

Affected product: D-Link DIR-X3260 routers; vulnerable component: prog.cgi handling HNAP requests on the lighttpd webserver. Root cause: stack-based buffer overflow due to improper validation of user-supplied data length in prog.cgi, enabling remote code execution. Impact: network-adjacent attack...

CVE-2023-44418

CVE-2023-44418 affects D-Link DIR-X3260 routers. The flaw is in prog.cgi (HNAP requests handled by lighttpd) where improper validation of user-supplied data length leads to a heap-based buffer overflow. This allows network-adjacent attackers to execute arbitrary code with root privileges without ...

CVE-2023-44409 D-Link DAP-1325 SetSetupWizardStatus Enabled Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetSetupWizardStatus Enabled Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this...

CVE-2023-44409

Summary: CVE-2023-44409 affects the D-Link DAP-1325, where the HNAP1 SOAP endpoint mishandles XML data, failing to validate data length before copying into a fixed-size stack buffer. This causes a stack-based overflow that can allow a network-adjacent attacker to execute code with root privileges...

CVE-2023-44409 D-Link DAP-1325 SetSetupWizardStatus Enabled Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetSetupWizardStatus Enabled Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this...

CVE-2023-44407

CVE-2023-44407 affects D-Link DAP-1325 routers via the SetAPLanSettings gateway. The vulnerability stems from a stack-based buffer overflow in handling XML data sent to the HNAP1 SOAP endpoint, caused by insufficient validation of user-supplied data length before copying to a fixed-length stack b...

CVE-2023-44407 D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this...

CVE-2023-44405

The vulnerability CVE-2023-44405 affects D-Link DAP-1325 routers. It stems from improper validation of user-supplied data in the XML processed by the HNAP1 SOAP endpoint, leading to a stack-based buffer overflow in a fixed-length buffer. This allows network-adjacent attackers to execute arbitrary...

CVE-2023-44404 D-Link DAP-1325 get_value_from_app Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 getvaluefromapp Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The...

CVE-2023-44403

CVE-2023-44403 affects D-Link DAP-1325 routers via the HNAP1 SOAP endpoint, SetWLanRadioSettings channel command handling. The vulnerability arises from insufficient validation of a user-supplied string used in a system call, allowing network-adjacent attackers to execute arbitrary code with root...

CVE-2023-42033

Visualware MyConnection Server is affected by CVE-2023-42033 via the doPostUploadfiles directory traversal, allowing remote code execution with root context. The flaw is due to insufficient validation of a user-supplied path before file operations. Exploitation requires authentication, but authen...

CVE-2023-41229

The CVE-2023-41229 issue affects the D-Link DIR-3040 router. A heap-based buffer overflow in the prog.cgi handler for HNAP requests processed by the lighttpd webserver (ports 80/443) arises from inadequate validation of a user-supplied string, enabling an attacker with network proximity to execut...

CVE-2023-41226

Summary of CVE-2023-41226 (D-Link DIR-3040): The vulnerability is a stack-based overflow in the prog.cgi binary that handles HNAP requests to the lighttpd webserver (ports 80/443). Lack of proper validation of a user-supplied string allows a network-adjacent attacker to trigger a remote code exec...

CVE-2023-41217

CVE-2023-41217 affects D-Link DIR-3040 routers. The vulnerability resides in the prog.cgi handling of HNAP requests to the lighttpd webserver on ports 80/443, where unsafely copied user input into a fixed-length stack buffer leads to a stack-based buffer overflow . This permits remote code execut...

CVE-2023-41216

CVE-2023-41216 affects D-Link DIR-3040 routers, specifically the prog.cgi endpoint handling HNAP requests on lighttpd ports 80/443. The vulnerability is a stack-based buffer overflow in SetDynamicDNSSettings that copies an unvalidated user-supplied string into a fixed-length stack buffer, enablin...

CVE-2023-41215 D-Link DAP-2622 DDP Set Date-Time Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP Set Date-Time Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The...

CVE-2023-41211 D-Link DAP-1325 SetHostIPv6StaticSettings StaticPrefixLength Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetHostIPv6StaticSettings StaticPrefixLength Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to...

CVE-2023-41211

CVE-2023-41211 affects D-Link DAP-1325. The flaw is a stack-based buffer overflow in SetHostIPv6StaticSettings StaticPrefixLength via the HNAP1 SOAP endpoint due to improper length validation of user-supplied XML data. Consequence: remote code execution with root privileges, exploitable by networ...

CVE-2023-41210 D-Link DAP-1325 SetHostIPv6StaticSettings StaticDNS2 Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetHostIPv6StaticSettings StaticDNS2 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this...

CVE-2023-41210

CVE-2023-41210 affects the D-Link DAP-1325 router. The vulnerability is a stack-based buffer overflow in the SetHostIPv6StaticSettings StaticDNS2 handler, due to improper validation of user-supplied data in XML passed to the HNAP1 SOAP endpoint. Exploitation could allow network-adjacent, unauthen...