CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 1CVE-2018-6212
https://notcve.org/view.php?id=CVE-2018-6212
On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, a reflected Cross-Site Scripting (XSS) attack is possible as a result of missed filtration for special characters in the "Search" field and incorrect processing of the XMLHttpRequest object. En dispositivos D-Link DIR-620 con una determinada variante personalizada (por proveedor de Internet) del firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0 y 2.0.22, es posible un ataque de Cross-Site Scripting (XSS) reflejado como resultado de la falta de filtrado de caracteres especiales en el campo "Search" y el procesamiento erróneo del objeto XMLHttpRequest. • http://www.securitynewspaper.com/2018/05/25/d-link-dir-620-routers-critical-vulnerabilities https://securelist.com/backdoors-in-d-links-backyard/85530 https://securityaffairs.co/wordpress/72839/hacking/d-link-dir-620-flaws.html https://www.bleepingcomputer.com/news/security/backdoor-account-found-in-d-link-dir-620-routers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 2%CPEs: 8EXPL: 1CVE-2018-6211
https://notcve.org/view.php?id=CVE-2018-6211
On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, OS command injection is possible as a result of incorrect processing of the res_buf parameter to index.cgi. En dispositivos D-Link DIR-620 con una determinada variante personalizada (por proveedor de Internet) del firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0 y 2.0.22, es posible la inyección de comandos del sistema operativo como resultado del procesamiento erróneo del parámetro res_buf en index.cgi. • http://www.securitynewspaper.com/2018/05/25/d-link-dir-620-routers-critical-vulnerabilities https://securelist.com/backdoors-in-d-links-backyard/85530 https://securityaffairs.co/wordpress/72839/hacking/d-link-dir-620-flaws.html https://www.bleepingcomputer.com/news/security/backdoor-account-found-in-d-link-dir-620-routers • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 8EXPL: 1CVE-2018-6213
https://notcve.org/view.php?id=CVE-2018-6213
In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there is a hardcoded password of anonymous for the admin account. En el servidor web de los dispositivos D-Link DIR-620 con una determinada variante personalizada (por proveedor de Internet) del firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0 y 2.0.22, hay una contraseña embebida "anonymous" para la cuenta de administrador. • http://www.securitynewspaper.com/2018/05/25/d-link-dir-620-routers-critical-vulnerabilities https://securelist.com/backdoors-in-d-links-backyard/85530 https://securityaffairs.co/wordpress/72839/hacking/d-link-dir-620-flaws.html https://www.bleepingcomputer.com/news/security/backdoor-account-found-in-d-link-dir-620-routers • CWE-798: Use of Hard-coded Credentials •