CVE-2019-17509

CVE-2019-17509 affects D-Link DIR-846 devices with firmware 100A35. Remote attackers with admin access can execute arbitrary OS commands as root by sending a crafted /HNAP1/ SetMasterWLanSettings request to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php using shell metacharacters. The...

CVE-2019-17510

CVE-2019-17510 affects D-Link DIR-846 devices running firmware 100A35, allowing remote attackers with admin access to execute arbitrary OS commands as root via a /HNAP1/ SetWizardConfig.php request using shell metacharacters. The issue targets the SetWizardConfig path under /squashfs-root/www/HNA...

CVE-2023-33735

CVE-2023-33735 affects D-Link DIR-846 v1.00A52. The vulnerability is a remote command execution via the tomography_ping_address parameter on the /HNAP1 interface, attributed to the HNAP1 handling in the device firmware. Impact is described as total (high confidentiality, integrity, and availabili...

CVE-2021-46319

CVE-2021-46319 is linked to a D-Link DIR-846 RCE issue previously observed as CVE-2019-17509. Connected sources describe a remote code execution path in DIR-846 devices, where an attacker can bypass shell metacharacters in ssid0/ssid1 via crafted input to execute arbitrary OS commands as root (e....

CVE-2021-46314

CVE-2021-46314 targets D-Link DIR-846 routers, with the flaw in HNAP1/control/SetNetworkTomographySettings.php. The issue is a backtick-based command injection in domain-name validation, enabling remote command execution over the network. Public sources (NVD) assign a CVSS v3.1 base score of 9.8 ...

CVE-2020-27600

This CVE affects D-Link DIR-846 routers (A1_100.26) where HNAP1/control/SetMasterWLanSettings.php allows remote command execution via shell metacharacters in the ssid0/ssid1 fields. The underlying issue is an OS command injection vulnerability enabling an attacker to run arbitrary commands on aff...

CVE-2021-46315

CVE-2021-46315 is a remote code execution vulnerability affecting D-Link DIR-846 series routers (examples: DIR846A1_FW100A43.bin, DIR846enFW100A53DLA-Retail.bin) via HNAP1/control/SetWizardConfig.php. The flaw allows an attacker to inject shell metacharacters (e.g., , backticks) in ssid0/ssid1 pa...

CVE-2022-46552

CVE-2022-46552 affects D-Link DIR-846 firmware FW100A53DBR, exposing a remote command execution vulnerability via the lan(0)_dhcps_staticlist parameter. The issue can be triggered by a crafted POST request, enabling arbitrary commands on the device. Multiple connected sources corroborate the vuln...

CVE-2022-46642

CVE-2022-46642 affects the D‑Link DIR‑846 A1 with firmware FW100A43. The root cause is improper input handling in the SetAutoUpgradeInfo function, where the parameter auto_upgrade_hour can be used to construct and execute commands, resulting in a remote command injection vulnerability. Impact per...

CVE-2023-43284

CVE-2023-43284 affects the D-Link DIR-846 wireless router (firmware variant 100A53DBR-Retail). The vulnerability is a code execution flaw caused by insufficient protection when handling the QoS POST parameter, allowing an authenticated remote attacker to execute arbitrary code. Multiple sources (...

CVE-2022-46641

CVE-2022-46641 concerns the D-Link DIR-846 A1_FW100A43 router, where a vulnerability in the SetIpMacBindSettings function allows command injection through the lan(0)_dhcps_staticlist parameter. This is a network‑vector issue with critical impact (CVSS 9.9) and affects confidentiality, integrity, ...

CVE-2020-21016

CVE-2020-21016 affects D-Link DIR-846 devices with firmware 100A35. The vulnerability arises from insufficient input/argument validation in the HNAP1/control/SetGuestWLanSettings.php endpoint, enabling remote code execution as root over the network. What is vulnerable: the specific endpoint and i...

CVE-2023-6580

CVE-2023-6580 concerns a deserialization vulnerability in the D-Link DIR-846 router (FW100A53DBR), specifically in the QoS POST Handler handling the file path /HNAP1/. The issue arises from unsafe deserialization when processing the arguments smartqos_express_devices and smartqos_normal_devices, ...