CVE-2019-13372

D-Link Central WiFi Manager CWM(100) is affected by a remote code execution vulnerability in /web/Lib/Action/IndexAction.class.php. Before v1.03R0100_BETA6, a crafted cookie can trigger eval injection via the cookie’s username field, and an empty password bypasses authentication, enabling unauthe...

CVE-2019-13374

CVE-2019-13374 affects D-Link Central WiFi Manager CWM(100) prior to version 1.03R0100_BETA6. The vulnerability is an XSS in the Resource View (PayAction.class.php) that allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter. Impact de...

CVE-2019-13373

Summary (CVE-2019-13373) : A vulnerability in D-Link Central WiFi Manager CWM-100 (versions before v1.03R0100_BETA6) where input is not validated, allowing arbitrary SQL commands via the /web/Public/Conn.php?dbSQL parameter. This can lead to database compromise, including retrieval of usernames/p...

CVE-2019-13375

CVE-2019-13375 relates to a SQL injection in the D-Link Central WiFi Manager CWM-100 (pre-1.03R0100_BETA6). The flaw resides in PayAction.class.php via the index.php/Pay/passcodeAuth parameter passcode, exploitable without authentication to leak data and modify the database. Connected Red Hat and...

CVE-2018-15517

CVE-2018-15517 affects D-Link Central WifiManager CWM-100, version 1.03 r0098, where the MailConnect feature (meant to check SMTP connections) improperly allows outbound TCP to any port/IP, enabling server-side request forgery (SSRF). Exploitation demos show a URI like index.php/System/MailConnec...

CVE-2018-17440

D-Link Central WiFi Manager (before 1.03r0100-Beta1) is vulnerable to remote code execution via an FTP service listening on port 9000 that uses hardcoded admin/admin credentials. An unauthenticated attacker can upload a PHP file to the web root and access it to execute arbitrary code. Core Securi...

CVE-2018-15516

CVE-2018-15516 affects the D-Link Central WiFiManager CWM-100, version 1.03 r0098, where the FTP server component can be abused to perform a PORT command bounce scan on port 8000, resulting in a Server-Side Request Forgery (SSRF) . Documented impact includes remote abuse of the network and potent...

CVE-2018-17442

CVE-2018-17442 affects D-Link Central WiFi Manager prior to version 1.03r0100-Beta1. The vulnerability lies in an unrestricted file upload via the onUploadLogPic endpoint, which can be exploited by remote authenticated users to achieve remote code execution (PHP) by uploading a crafted archive (....

CVE-2018-17441

CVE-2018-17441 affects D-Link Central WiFi Manager prior to version 1.03r0100-Beta1. The vulnerability is a stored XSS in the addUser endpoint’s username parameter, enabling injection of web scripts into the UI. Impact per sources is limited to client-side script execution; no server-side comprom...

CVE-2018-17443

CVE-2018-17443 affects D-Link Central WiFi Manager prior to 1.03r0100-Beta1. The vulnerability is a stored XSS in the sitename parameter of the UpdateSite endpoint, enabling injection of arbitrary script/HTML when a user visits the affected page. Public details in connected sources confirm the is...

CVE-2018-15515

The CVE-2018-15515 entry concerns D-LINK Central WiFiManager CWM-100 (firmware 1.03 r0098). The vulnerability arises from loading Trojan file quserex.dll from the CaptivelPortal.exe subdirectory, enabling a local unprivileged user to gain SYSTEM privileges via a Trojan/DLL hijack scenario. The co...