dir-846_firmware Archives - CVE Vulnerability

CVE-2020-27600

Sun, 26 Feb 2023 06:40:22 +0000

HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter.

The post CVE-2020-27600 appeared first on CVE Vulnerability.

CVE-2020-21016

Sun, 26 Feb 2023 06:38:55 +0000

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php.

The post CVE-2020-21016 appeared first on CVE Vulnerability.

CVE-2019-17509

Sun, 26 Feb 2023 06:31:35 +0000

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php.

The post CVE-2019-17509 appeared first on CVE Vulnerability.

CVE-2019-17510

Sun, 26 Feb 2023 06:31:35 +0000

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php.

The post CVE-2019-17510 appeared first on CVE Vulnerability.

CVE-2021-46314

Thu, 23 Feb 2023 14:13:05 +0000

A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for command injection when judging whether it is a reasonable domain name.

The post CVE-2021-46314 appeared first on CVE Vulnerability.

CVE-2021-46315

Thu, 23 Feb 2023 14:13:05 +0000

Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use ” ” or backticks in the shell metacharacters in the ssid0 or ssid1 parameters to cause arbitrary command execution. Since CVE-2019-17510 vulnerability has not been patched and improved www/hnap1/control/setwizardconfig.php, can also use line breaks and backquotes to bypass.

The post CVE-2021-46315 appeared first on CVE Vulnerability.

CVE-2021-46319

Thu, 23 Feb 2023 14:13:05 +0000

Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use ” ” or backticks to bypass the shell metacharacters in the ssid0 or ssid1 parameters to execute arbitrary commands.This vulnerability is due to the fact that CVE-2019-17509 is not fully patched and can be bypassed by using line breaks or backticks on its basis.

The post CVE-2021-46319 appeared first on CVE Vulnerability.

CVE-2022-46641

godfreyd94 — Thu, 23 Feb 2023 05:21:38 +0000

D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIpMacBindSettings function.

The post CVE-2022-46641 appeared first on CVE Vulnerability.

CVE-2022-46642

godfreyd94 — Thu, 23 Feb 2023 05:21:38 +0000

D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.

The post CVE-2022-46642 appeared first on CVE Vulnerability.

CVE-2022-46552

godfreyd94 — Thu, 23 Feb 2023 05:21:37 +0000

D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted POST request.

The post CVE-2022-46552 appeared first on CVE Vulnerability.