CVE-2019-10891

CVE-2019-10891 affects D-Link DIR-806 devices. The issue is a command injection in the hnap_main function where system() is called with a parameter controllable by the user, enabling remote attackers to execute arbitrary shell commands via a special HTTP header. The CVE is rated critical (CVSS 3....

CVE-2019-10892

The CVE-2019-10892 issue affects D-Link DIR-806 devices. A stack-based buffer overflow exists in function hnap_main in /htdocs/cgibin, triggered when the server processes specially crafted HTTP headers. The code path calls sprintf without validating the length of input strings from HTTP headers, ...

CVE-2025-4340

CVE-2025-4340 affects D-Link DIR-890L and DIR-806A1; the vulnerability is a remote command injection in the function sub_175C8 of /htdocs/soap.cgi. The root cause is improper handling/filters of crafted characters in that function, allowing an attacker to execute arbitrary commands remotely. Affe...

CVE-2023-43128

The CVE-2023-43128 entry targets D-LINK DIR-806 1200M11AC, specifically the DIR806A1_FW100CNb11 firmware. The root cause is lax filtering of the HTTP_ST parameter, enabling a remote attacker to perform command injection. The vulnerability is classified with CVSS v3.1 base metrics: CVSS:3.1/AV:N/A...

CVE-2023-43129

The CVE-2023-43129 entry concerns D-LINK DIR-806 devices (DIR806A1_FW100CNb11) with a command injection flaw caused by lax filtering of the REMOTE_PORT parameter. Affected component/firmware: DIR-806 wireless router family; root cause: insufficient input sanitization of REMOTE_PORT, enabling arbi...

CVE-2023-43130

CVE-2023-43130 affects D-LINK DIR-806 1200M11AC wireless router, specifically DIR806A1_FW100CNb11. Root cause is a command injection vulnerability in the device’s firmware. Exploitation is described as network-based with no authentication required and no user interaction, leading to total impact ...