Filtered by vendor D-link Subscriptions
Total 228 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-32139 1 D-link 1 Dap-1360 2024-11-21 N/A
D-Link DAP-1360 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-18417.
CVE-2023-32138 1 D-link 1 Dap-1360 2024-11-21 N/A
D-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-18416.
CVE-2023-32137 1 D-link 2 Dap-1360f1 Firmware, Dap-2020 Firmware 2024-11-21 N/A
D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. . Was ZDI-CAN-18415.
CVE-2022-44929 1 D-link 2 Dvg-g5402sp, Dvg-g5402sp Firmware 2024-11-21 9.8 Critical
An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles.
CVE-2022-44928 1 D-link 2 Dvg-g5402sp, Dvg-g5402sp Firmware 2024-11-21 9.8 Critical
D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.
CVE-2022-29778 2 D-link, Dlink 3 Dir-890l Firmware, Dir-890l, Dir-890l Firmware 2024-11-21 8.8 High
D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSettings.php
CVE-2021-41503 2 D-link, Dlink 4 Dcs-5000l Firmware, Dcs-5000l, Dcs-932l and 1 more 2024-11-21 8.0 High
DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-33259 2 D-link, Dlink 2 Dir-868lw Firmware, Dir-868lw 2024-11-21 5.3 Medium
Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users' DNS query history.
CVE-2021-26709 1 D-link 1 Dsl-320b-d1 2024-11-21 9.8 Critical
D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device via the login.xgi user and pass parameters. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2020-9544 1 D-link 2 Dsl-2640b, Dsl-2640b Firmware 2024-11-21 7.5 High
An issue was discovered on D-Link DSL-2640B E1 EU_1.01 devices. The administrative interface doesn't perform authentication checks for a firmware-update POST request. Any attacker that can access the administrative interface can install firmware of their choice.
CVE-2020-19323 2 D-link, Dlink 3 Dir-619l, Dir-619l, Dir-619l Firmware 2024-11-21 7.5 High
An issue was discovered in /bin/mini_upnpd on D-Link DIR-619L 2.06beta devices. There is a heap buffer overflow allowing remote attackers to restart router via the M-search request ST parameter. No authentication required
CVE-2020-19320 2 D-link, Dlink 3 Dir-619l, Dir-619l, Dir-619l Firmware 2024-11-21 9.8 Critical
Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the curTime parameter on login.
CVE-2020-19319 2 D-link, Dlink 3 202l, Dir-619l, Dir-619l Firmware 2024-11-21 9.8 Critical
Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the FILECODE parameter on login.
CVE-2020-19318 2 D-link, Dlink 3 Dir-605l, Dir-605l, Dir-605l Firmware 2024-11-21 8.8 High
Buffer Overflow vulnerability in D-Link DIR-605L, hardware version AX, firmware version 1.17beta and below, allows authorized attackers execute arbitrary code via sending crafted data to the webserver service program.
CVE-2020-15633 2 D-link, Dlink 6 Dir-867 Firmware, Dir-878 Firmware, Dir-882 Firmware and 3 more 2024-11-21 8.8 High
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835.
CVE-2019-9125 2 D-link, Dlink 2 Dir-878 Firmware, Dir-878 2024-11-21 N/A
An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not require authentication via the HNAP_AUTH HTTP header.
CVE-2019-9124 2 D-link, Dlink 2 Dir-878 Firmware, Dir-878 2024-11-21 N/A
An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password.
CVE-2019-7297 2 D-link, Dlink 2 Dir-823g Firmware, Dir-823g 2024-11-21 N/A
An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system function with an untrusted input parameter named Address. Consequently, an attacker can execute any command remotely when they control this input.
CVE-2019-6258 2 D-link, Dlink 2 Dir-822 Firmware, Dir-822 2024-11-21 9.8 Critical
D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo HNAP protocol message, which is mishandled in /usr/sbin/udhcpd during reading of the /var/servd/LAN-1-udhcpd.conf file.
CVE-2019-17663 2 D-link, Dlink 2 Dir-866l Firmware, Dir-866l 2024-11-21 6.1 Medium
D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection.