dir-859_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/dir-859_firmware/ Sun, 26 Feb 2023 06:32:21 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png dir-859_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/dir-859_firmware/ 32 32 CVE-2019-20215 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-20215/ Sun, 26 Feb 2023 06:32:21 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-20215/ D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.

The post CVE-2019-20215 appeared first on CVE Vulnerability.

]]> D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.

The post CVE-2019-20215 appeared first on CVE Vulnerability.

]]> CVE-2019-20216 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-20216/ Sun, 26 Feb 2023 06:32:21 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-20216/ D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.

The post CVE-2019-20216 appeared first on CVE Vulnerability.

]]> D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.

The post CVE-2019-20216 appeared first on CVE Vulnerability.

]]> CVE-2019-20217 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-20217/ Sun, 26 Feb 2023 06:32:21 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-20217/ D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.

The post CVE-2019-20217 appeared first on CVE Vulnerability.

]]> D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.

The post CVE-2019-20217 appeared first on CVE Vulnerability.

]]> CVE-2022-25106 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-25106/ Thu, 23 Feb 2023 05:17:34 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-25106/ D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.

The post CVE-2022-25106 appeared first on CVE Vulnerability.

]]> D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.

The post CVE-2022-25106 appeared first on CVE Vulnerability.

]]>