CVE-2022-43626

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

D-Link DIR-1935 命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based D-Link. The D-Link DIR-1935 suffers from a command injection vulnerability that originates when parsing WebFilterURLs elements, where the process does not properly validate before executing a system call with a user-supplied string...

CVE-2022-43646

CVE-2022-43646 affects D-Link DIR-825 (versions 1.0.9/EE). The vulnerability is in the Vimeo plugin for the xupnpd service (listening on TCP 4044) where unvalidated user-supplied strings are used to spawn a system call, allowing network-adjacent attackers to execute arbitrary code as the admin us...

CVE-2022-43624

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43627

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43627

CVE-2022-43627 affects D-Link DIR-1935 with firmware 1.03. The flaw: during SetStaticRouteIPv4Settings handling, parsing of StaticRouteIPv4Data does not validate a user-supplied string before a system call, enabling remote code execution with root privileges for network-adjacent attackers; authen...

CVE-2022-43633

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-42433

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841NUSV14220121 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2022-43647

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044. The issue...

CVE-2022-43632

CVE-2022-43632 affects D-Link DIR-1935 firmware 1.03. The flaw is in SetQoSSettings QoSInfo parsing: unvalidated user-supplied data is used in a system call, allowing network-adjacent attackers to achieve code execution as root. Exploitation details are documented by ZDI (ZDI-22-1504) and other f...

CVE-2022-43631

CVE-2022-43631 affects D-Link DIR-1935 (firmware 1.03). The bug is in the web portal’s SetVirtualServerSettings handling, where parsing subelements of VirtualServerInfo does not properly validate a user-supplied string before it is used to execute a system call. This enables network-adjacent atta...

CVE-2022-43629

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-3210

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044 by defaul...

CVE-2022-43642

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the YouTube plugin for the xupnpd service, which listens on TC...

CVE-2022-42433

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841NUSV14220121 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China's AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that originates when parsing sub-elements within a VirtualServerInfo element, where the process does not properly validate before executing a syst...

CVE-2022-43623

CVE-2022-43623 affects D-Link DIR-1935 1.03. The vulnerability is a command-injection flaw in the web management portal’s handling of the SetWebFilterSetting request, specifically when parsing the WebFilterURLs element. A user-supplied string is not properly validated before being used to execute...

CVE-2022-43631

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that stems from a process not properly validating before executing a system call with a user-supplied string when parsing sub-elements within ...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that originates when parsing sub-elements of a StaticRouteIPv4Data element, where the process does not properly validate before executing a...