Vulnerabilities for Dir-822 firmware (...) - CXSECURITY.COM

Vulnerabilities for 'Dir-822 firmware'

2019-05-13

CVE-2018-19990

CWE-78

In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pin" and $rphyinf3."/media/wps/enrollee/pin" internal configuration memory without any regex checking. And in the do_wps function of the wps.php source code, the data in $rphyinf3."/media/wps/enrollee/pin" is used with the wpatalk command without any regex checking. A vulnerable /HNAP1/SetWiFiVerifyAlpha XML message could have shell metacharacters in the WPSPIN element such as the `telnetd` string.

CVE-2018-19989

CWE-78

In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 devices. In the SetQoSSettings.php source code, the uplink parameter is saved in the /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth internal configuration memory without any regex checking. And in the bwc_tc_spq_start, bwc_tc_wfq_start, and bwc_tc_adb_start functions of the bwcsvcs.php source code, the data in /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth is used with the tc command without any regex checking. A vulnerable /HNAP1/SetQoSSettings XML message could have shell metacharacters in the uplink element such as the `telnetd` string.

CVE-2018-19987

CWE-78

D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPoint in /HNAP1/SetAccessPointMode. In the SetAccessPointMode.php source code, the IsAccessPoint parameter is saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. A vulnerable /HNAP1/SetAccessPointMode XML message could have shell metacharacters in the IsAccessPoint element such as the `telnetd` string.

CVE-2018-19986

CWE-78

In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 devices. In the SetRouterSettings.php source code, the RemotePort parameter is saved in the $path_inf_wan1."/web" internal configuration memory without any regex checking. And in the IPTWAN_build_command function of the iptwan.php source code, the data in $path_inf_wan1."/web" is used with the iptables command without any regex checking. A vulnerable /HNAP1/SetRouterSettings XML message could have shell metacharacters in the RemotePort element such as the `telnetd` string.

2016-08-25

CVE-2016-5681

Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before 3.01WWb02, DIR-823 A1 1.00 before 1.00WWb05, DIR-895L A1 1.11 before 1.11WWb04, DIR-890L A1 1.09 before 1.09b14, DIR-885L A1 1.11 before 1.11WWb07, DIR-880L A1 1.07 before 1.07WWb08, DIR-868L B1 2.03 before 2.03WWb01, and DIR-868L C1 3.00 before 3.00WWb01 devices allows remote attackers to execute arbitrary code via a long session cookie.

>>> Vendor: D-link 231 Products

Dcs-900 internet camera

Dsa-3100 airspot gateway

Di-604 broadband router

Ebr-2310 ethernet broadband router

Wbr-1310 wireless g router

Wbr-2310 rangebooster g router

Mpeg4 shm audio control

Camera stream client activex control

Dcs-5605 ptz ip network camera

Dcs-932l camera

Dcs-932l camera firmware

Dsr-1000 firmware

Dsr-1000n firmware

Dsr-150 firmware

Dsr-150n firmware

Dsr-250 firmware

Dsr-250n firmware

Dsr-500 firmware

Dsr-500n firmware

Dap 2253 firmware

Dir-505l shareport mobile companion

Dir-826l wireless n600 cloud router

Dir-505l shareport mobile companion firmware

Dir-826l wireless n600 cloud router firmware

Dap 1150 firmware

Dap-1350 firmware

Dir505 shareport mobile companion

Dir505 shareport mobile companion firmware

Dir505l shareport mobile companion firmware

Dsp-w215 firmware

Dir-601 firmware

Dir-645 firmware

Dcs-2103 hd cube network camera

Dcs-2103 hd cube network camera firmware

Dir-655 firmware

Dir-600 firmware

Dap-1360 firmware

Dsl-2730b firmware

Dcs-931l firmware

Dap-1320 firmware

Dcs-932l firmware

See all Products for Vendor D-link

Copyright 2024, cxsecurity.com