Dlink vulnerabilities

CVE-2019-16057 Critical · 9.8 KEV Urgent · 77 Public exploit Ransomware CWE-78 Sep 16, 2019

D-Link DNS-320 Remote Code Execution Vulnerability

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

CVE-2018-6530 Critical · 9.8 KEV Urgent · 77 Public exploit Ransomware CWE-78 Mar 6, 2018

D-Link Multiple Routers OS Command Injection Vulnerability

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

CVE-2015-1187 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-287 Sep 21, 2017

D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

CVE-2014-8361 Critical · 9.8 KEV Urgent · 83 Public exploit May 1, 2015

Realtek SDK Improper Input Validation Vulnerability

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

CVE-2015-2051 High · 8.8 KEV Urgent · 76 Public exploit CWE-77 Feb 23, 2015

D-Link DIR-645 Router Remote Code Execution Vulnerability

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

CVE-2014-100005 High · 8.0 KEV High · 68 Public exploit CWE-352 Jan 13, 2015

D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.

CVE-2013-5223 Medium · 5.4 KEV High · 61 Public exploit CWE-79 Nov 19, 2013

D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.

CVE-2011-4723 Medium · 5.7 KEV High · 51 CWE-312 Dec 20, 2011

D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability

The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.