CVE-2022-43647

CVE-2022-43647 affects D-Link DIR-825 routers (versions 1.0.9/EE). The vulnerability in the xupnpd service listens on TCP port 4044 and stems from improper validation of a user-supplied string before it’s used to execute a system call. This allows network-adjacent attackers (no authentication req...

CVE-2022-43633

This CVE affects D-Link DIR-1935 routers running v1.03. The underlying issue is a command injection in the web management portal: during parsing of the IPAddress field in SetSysLogSettings, input is insufficiently validated before being passed to a system call, allowing a network-adjacent attacke...

CVE-2022-43627

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

D-Link DIR-825 操作系统命令注入漏洞

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call using it...

TP-LINK TL-WR841N 操作系统命令注入漏洞

The TP-LINK TL-WR841N is a wireless router from China P&L TP-LINK. The TP-LINK TL-WR841N suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call with it...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China's AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that originates when parsing sub-elements within a VirtualServerInfo element, where the process does not properly validate before executing a syst...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that originates when parsing sub-elements of a StaticRouteIPv4Data element, where the process does not properly validate before executing a...

CVE-2022-43631

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43629

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43642

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the YouTube plugin for the xupnpd service, which listens on TC...

CVE-2022-43647

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044. The issue...

CVE-2022-43643

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Generic plugin for the xupnpd service, which listens on TC...

CVE-2022-42433

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841NUSV14220121 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that originates when parsing sub-elements within a QoSInfo element, where the process does not properly validate before executing a system cal...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that stems from a process not properly validating before executing a system call with a user-supplied string when parsing sub-elements within ...

CVE-2022-43643

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Generic plugin for the xupnpd service, which listens on TC...

CVE-2022-43631

CVE-2022-43631 affects D-Link DIR-1935 (firmware 1.03). The bug is in the web portal’s SetVirtualServerSettings handling, where parsing subelements of VirtualServerInfo does not properly validate a user-supplied string before it is used to execute a system call. This enables network-adjacent atta...

CVE-2022-43629

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43626

CVE-2022-43626 affects the D-Link DIR-1935 (version 1.03). The flaw is in the web management SetIPv4FirewallSettings handling of IPv4FirewallRule elements, where a user-supplied string isn’t properly validated before it’s used in a system call, enabling arbitrary code execution in the root contex...

CVE-2022-43623

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...