CVE-2017-8410

The CVE-2017-8410 issue affects D-Link DCS-1100 and DCS-1130 cameras. The rtspd RTSP handler in /sbin performs a memcpy using the Authorization: Basic header data, with copy length derived from the header string length, causing a stack overwrite and memory corruption. This leads to potential arbi...

CVE-2017-8415

Affected devices: D-Link DCS-1100 and DCS-1130. The vulnerability stems from a hardcoded credential mechanism used by a custom telnet daemon (part of BusyBox) where the password check uses a salted hash of the string "admin" stored in /etc/shadow on a CRAM-FS filesystem. Because the filesystem is...

CVE-2017-8412

CVE-2017-8412 affects D-Link DCS-1100 and DCS-1130 devices. A custom mp4ts binary in /var/www/video dumps the HTTP VERB into logs and copies user input via a vulnerable sprintf into a string without bounds checking, leading to a stack overflow that can overwrite the PC and enable buffer overflow ...

CVE-2017-8417

Affected products: D-Link DCS-1100 and DCS-1130 network cameras. Vulnerability: An authentication bypass allows a third party to retrieve the device password without user credentials by abusing a custom base64-encoded communication channel between D-Link apps and the device, exploitable via sendi...

CVE-2017-8413

Summary: CVE-2017-8413 affects D-Link DCS-1100 and DCS-1130 network cameras. A custom UDP-based discovery daemon (port 5978, named dldps2121) processes broadcast packets. If a packet with type S (0x53) is received, the base64-encoded parameter C is decoded and passed to a system API, enabling com...

CVE-2017-8405

CVE-2017-8405 affects D-Link DCS-1130 and DCS-1100 cameras. The rtspd binary loads an Authenticate flag (default 0) that governs access to the video feed. While HTTP management requires login, RTSP does not enforce authentication by default, because the corresponding checkbox is unchecked. This c...

CVE-2013-1599

CVE-2013-1599 is a remote OS command-injection vulnerability in the D-Link IP cameras’ web interface, specifically in /var/www/cgi-bin/rtpd.cgi. A remote attacker can craft a request to trigger arbitrary command execution on affected devices. Affected devices include DCS-3411/3430 (1.02), DCS-560...

CVE-2017-8414

CVE-2017-8414 affects D-Link DCS-1100 and DCS-1130 network cameras. The /sbin orthrus UPnP handler takes the command-line parameter -f and performs a sprintf to the stack without length checking, which corrupts registers in a function (sub_A098) and leads to memory corruption. Public advisories (...

CVE-2017-8416

The CVE-2017-8416 issue affects D-Link DCS-1100 and DCS-1130 devices. A daemon listening on UDP port 5978 processes a custom discovery protocol; an unbounded copy (strcpy) within packet handling can overflow the stack, enabling remote code execution. An attacker on the local network can trigger t...

CVE-2013-1603

Summary of CVE-2013-1603 and related D-Link IP Camera vulnerabilities (CVE‑2013‑1599, -1600, -1601, -1602, -1603): Core Security’s CORE-2013-0303 advisory documents OS command injection, several authentication issues, information leakage, and hard-coded credentials affecting D‑Link IP cameras (mo...

CVE-2013-1602

CVE-2013-1602 describes an information-disclosure and authentication-bypass vulnerability in several D-Link IP cameras (e.g., DCS-5635, DCS-1100/1130/1100L/1130L, DCS-2102/2121, DCS-3410/5230/5610, WCS-1100, etc.). The root cause is insufficient validation of RTSP authentication cookies, enabling...

CVE-2013-1601

CVE-2013-1601 is an information-disclosure vulnerability in D-Link IP cameras where an unauthenticated attacker can access an ASCII output of the live video stream via /md/lums.cgi. Connected sources (CoreLabs CORE-2013-0303) confirm this vulnerability alongside related CVEs (1599, 1600, 1602, 16...