Dlink: Security Vulnerabilities
CVE-2020-9377
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Known exploited
CVSS Score
8.8
EPSS Score
0.213
Published
2020-07-09
D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately 90 seconds of access to the control panel, after a restart, before MAC address filtering rules become active.
CVSS Score
7.8
EPSS Score
0.003
Published
2020-06-15
D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, which allows remote attackers to provide valid DNS responses (and also offer Internet services such as HTTP) for names that otherwise would have had an NXDOMAIN error, by registering a subdomain of the domain.name domain name.
CVSS Score
7.5
EPSS Score
0.012
Published
2020-06-08
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
CVSS Score
7.5
EPSS Score
0.152
Published
2020-06-08
D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information.
CVSS Score
7.5
EPSS Score
0.009
Published
2020-06-03
D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.
CVSS Score
7.5
EPSS Score
0.013
Published
2020-06-03
D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength.
CVSS Score
7.5
EPSS Score
0.006
Published
2020-06-03
D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF.
CVSS Score
8.8
EPSS Score
0.007
Published
2020-06-03
D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information.
CVSS Score
7.5
EPSS Score
0.009
Published
2020-06-03
D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection.
CVSS Score
8.8
EPSS Score
0.271
Published
2020-06-03