Design/Logic Flaw

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044. The issue...

Design/Logic Flaw

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43624

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

D-Link DIR-825 操作系统命令注入漏洞

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call using it...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that originates when parsing an IPAddress element, where the process does not properly validate before executing a system call with a...

CVE-2022-43627

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43633

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43646

CVE-2022-43646 affects D-Link DIR-825 (versions 1.0.9/EE). The vulnerability is in the Vimeo plugin for the xupnpd service (listening on TCP 4044) where unvalidated user-supplied strings are used to spawn a system call, allowing network-adjacent attackers to execute arbitrary code as the admin us...

D-Link DIR-1935 命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based D-Link. The D-Link DIR-1935 suffers from a command injection vulnerability that originates when parsing WebFilterURLs elements, where the process does not properly validate before executing a system call with a user-supplied string...

CVE-2022-43645

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IVI plugin for the xupnpd service, which listens on TCP po...

CVE-2022-43626

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43624

Affected product: D-Link DIR-1935, firmware version 1.03. The vulnerability (CVE-2022-43624) is a command injection flaw in the web management portal, triggered by parsing subelements inside StaticRouteIPv6List during SetStaticRouteIPv6Settings handling. The issue allows network-adjacent attacker...

CVE-2022-43647

CVE-2022-43647 affects D-Link DIR-825 routers (versions 1.0.9/EE). The vulnerability in the xupnpd service listens on TCP port 4044 and stems from improper validation of a user-supplied string before it’s used to execute a system call. This allows network-adjacent attackers (no authentication req...

CVE-2022-43633

This CVE affects D-Link DIR-1935 routers running v1.03. The underlying issue is a command injection in the web management portal: during parsing of the IPAddress field in SetSysLogSettings, input is insufficiently validated before being passed to a system call, allowing a network-adjacent attacke...

CVE-2022-42433

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841NUSV14220121 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2022-43627

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43628

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

TP-LINK TL-WR841N 操作系统命令注入漏洞

The TP-LINK TL-WR841N is a wireless router from China P&L TP-LINK. The TP-LINK TL-WR841N suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call with it...

CVE-2022-43627

CVE-2022-43627 affects D-Link DIR-1935 with firmware 1.03. The flaw: during SetStaticRouteIPv4Settings handling, parsing of StaticRouteIPv4Data does not validate a user-supplied string before a system call, enabling remote code execution with root privileges for network-adjacent attackers; authen...