Dlink: Security Vulnerabilities
DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface.
CVSS Score
8.8
EPSS Score
0.012
Published
2019-12-26
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
CVSS Score
4.8
EPSS Score
0.198
Published
2019-12-18
On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal.
CVSS Score
6.5
EPSS Score
0.089
Published
2019-12-16
D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.
CVSS Score
8.8
EPSS Score
0.208
Published
2019-12-05
D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value. In HTTP requests, part of the HNAP_AUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to the value stored in the device's /var/hnap/timestamp file, the request will pass the HNAP_AUTH check function.
CVSS Score
8.8
EPSS Score
0.035
Published
2019-12-05
Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 (for DCN), DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842 C1 v3.00.
CVSS Score
9.8
EPSS Score
0.016
Published
2019-11-11
D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba share.
CVSS Score
8.8
EPSS Score
0.015
Published
2019-10-25
D-Link DIR-865L has Information Disclosure.
CVSS Score
6.5
EPSS Score
0.009
Published
2019-10-25
D-Link DIR-865L has PHP File Inclusion in the router xml file.
CVSS Score
9.8
EPSS Score
0.016
Published
2019-10-25
There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to log_clear.php, which could be used to erase attack traces.
CVSS Score
9.1
EPSS Score
0.015
Published
2019-10-16