d-link Archives - CVE Vulnerability

CVE-2019-9126

Sun, 26 Feb 2023 06:34:51 +0000

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the router_info.xml document. This will reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN information of the device.

The post CVE-2019-9126 appeared first on CVE Vulnerability.

CVE-2019-9123

Sun, 26 Feb 2023 06:34:51 +0000

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The “user” account has a blank password.

The post CVE-2019-9123 appeared first on CVE Vulnerability.

CVE-2019-9122

Sun, 26 Feb 2023 06:34:51 +0000

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntp_server parameter in an ntp_sync.cgi POST request.

The post CVE-2019-9122 appeared first on CVE Vulnerability.

CVE-2019-20501

Sun, 26 Feb 2023 06:32:26 +0000

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface, using shell metacharacters in the admin.cgi?action=upgrade firmwareRestore or firmwareServerip parameter.

The post CVE-2019-20501 appeared first on CVE Vulnerability.

CVE-2019-20500

Sun, 26 Feb 2023 06:32:26 +0000

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

The post CVE-2019-20500 appeared first on CVE Vulnerability.

CVE-2019-20499

Sun, 26 Feb 2023 06:32:26 +0000

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_restore configRestore or configServerip parameter.

The post CVE-2019-20499 appeared first on CVE Vulnerability.

CVE-2019-19224

Sun, 26 Feb 2023 06:32:00 +0000

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to download the configuration (binary file) settings by submitting a rom-0 GET request without being authenticated on the admin interface.

The post CVE-2019-19224 appeared first on CVE Vulnerability.

CVE-2019-19226

Sun, 26 Feb 2023 06:32:00 +0000

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to enable or disable MAC address filtering by submitting a crafted Forms/WlanMacFilter_1 POST request without being authenticated on the admin interface.

The post CVE-2019-19226 appeared first on CVE Vulnerability.

CVE-2019-19225

Sun, 26 Feb 2023 06:32:00 +0000

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without being authenticated on the admin interface by submitting a crafted Forms/dns_1 POST request.

The post CVE-2019-19225 appeared first on CVE Vulnerability.

CVE-2019-19223

Sun, 26 Feb 2023 06:32:00 +0000

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to reboot the router by submitting a reboot.html GET request without being authenticated on the admin interface.

The post CVE-2019-19223 appeared first on CVE Vulnerability.