dir-825_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/dir-825_firmware/ Sun, 26 Feb 2023 06:35:44 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png dir-825_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/dir-825_firmware/ 32 32 CVE-2020-10213 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10213/ Sun, 26 Feb 2023 06:35:44 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10213/ An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.

The post CVE-2020-10213 appeared first on CVE Vulnerability.

]]> An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.

The post CVE-2020-10213 appeared first on CVE Vulnerability.

]]> CVE-2020-10214 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10214/ Sun, 26 Feb 2023 06:35:44 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10214/ An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntp_sync.cgi with a sufficiently long parameter ntp_server.

The post CVE-2020-10214 appeared first on CVE Vulnerability.

]]> An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntp_sync.cgi with a sufficiently long parameter ntp_server.

The post CVE-2020-10214 appeared first on CVE Vulnerability.

]]> CVE-2020-10215 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10215/ Sun, 26 Feb 2023 06:35:44 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10215/ An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.

The post CVE-2020-10215 appeared first on CVE Vulnerability.

]]> An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.

The post CVE-2020-10215 appeared first on CVE Vulnerability.

]]> CVE-2020-10216 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10216/ Sun, 26 Feb 2023 06:35:44 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10216/ An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.

The post CVE-2020-10216 appeared first on CVE Vulnerability.

]]> An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.

The post CVE-2020-10216 appeared first on CVE Vulnerability.

]]> CVE-2021-46441 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-46441/ Thu, 23 Feb 2023 14:13:07 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-46441/ In the “webupg” binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use “cmd” parameters to execute arbitrary system commands after obtaining authorization.

The post CVE-2021-46441 appeared first on CVE Vulnerability.

]]> In the “webupg” binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use “cmd” parameters to execute arbitrary system commands after obtaining authorization.

The post CVE-2021-46441 appeared first on CVE Vulnerability.

]]> CVE-2021-46442 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-46442/ Thu, 23 Feb 2023 14:13:07 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-46442/ In the “webupg” binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters “autoupgrade.asp”, and perform functions such as downloading configuration files and updating firmware without authorization.

The post CVE-2021-46442 appeared first on CVE Vulnerability.

]]> In the “webupg” binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters “autoupgrade.asp”, and perform functions such as downloading configuration files and updating firmware without authorization.

The post CVE-2021-46442 appeared first on CVE Vulnerability.

]]> CVE-2021-29296 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-29296/ Thu, 23 Feb 2023 14:08:58 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-29296/ ** UNSUPPORTED WHEN ASSIGNED **Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vulnerability could be triggered by sending an HTTP request with URL /vct_wan; the sbin/httpd would invoke the strchr function and take NULL as a first argument, which finally leads to […]

The post CVE-2021-29296 appeared first on CVE Vulnerability.

]]> ** UNSUPPORTED WHEN ASSIGNED **Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vulnerability could be triggered by sending an HTTP request with URL /vct_wan; the sbin/httpd would invoke the strchr function and take NULL as a first argument, which finally leads to the segmentation fault. NOTE: The DIR-825 and all hardware revisions is considered End of Life and as such this issue will not be patched.

The post CVE-2021-29296 appeared first on CVE Vulnerability.

]]> CVE-2022-47035 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-47035/ Thu, 23 Feb 2023 05:21:41 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-47035/ Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPE endpoint.

The post CVE-2022-47035 appeared first on CVE Vulnerability.

]]> Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPE endpoint.

The post CVE-2022-47035 appeared first on CVE Vulnerability.

]]> CVE-2022-29332 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-29332/ Thu, 23 Feb 2023 05:18:26 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-29332/ D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. An attacker could use the “../../../../” setting of the FTP server folder to set the router’s root folder for FTP access. This allows you to access the entire router file system via the FTP server.

The post CVE-2022-29332 appeared first on CVE Vulnerability.

]]> D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. An attacker could use the “../../../../” setting of the FTP server folder to set the router’s root folder for FTP access. This allows you to access the entire router file system via the FTP server.

The post CVE-2022-29332 appeared first on CVE Vulnerability.

]]>