CVSS: 8.8EPSS: 0%CPEs: 20EXPL: 3CVE-2019-10999
https://notcve.org/view.php?id=CVE-2019-10999
The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The overflow allows a remotely authenticated attacker to execute arbitrary code by providing a long string in the WEPEncryption parameter when requesting wireless.htm. Vulnerable devices include DCS-5009L (1.08.11 and below), DCS-5010L (1.14.09 and below), DCS-5020L (1.15.12 and below), DCS-5025L (1.03.07 and below), DCS-5030L (1.04.10 and below), DCS-930L (2.16.01 and below), DCS-931L (1.14.11 and below), DCS-932L (2.17.01 and below), DCS-933L (1.14.11 and below), and DCS-934L (1.05.04 and below). Las series DCS de D-Link de cámaras Wi-Fi contienen una vulnerabilidad de desbordamiento de búfer basado en pila en alphapd, el servidor web de la cámara. El desbordamiento permite a un atacante autenticado de forma remota ejecutar código arbitrario proporcionando una cadena larga en el parámetro WEPEncryption cuando solicita wireless.htm. • https://github.com/tacnetsol/CVE-2019-10999 https://github.com/qjh2333/CVE-2019-10999 https://github.com/fuzzywalls/CVE-2019-10999 https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10131 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 2CVE-2017-17020 – DLINK DCS-5020L - Remote Code Execution (PoC)
https://notcve.org/view.php?id=CVE-2017-17020
On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DCS-5020L devices with firmware before 1.15.01, command injection in alphapd (binary responsible for running the camera's web server) allows remote authenticated attackers to execute code through sanitized /setSystemAdmin user input in the AdminID field being passed directly to a call to system. En dispositivos D-Link DCS-5009 con firmware 1.08.11 y anterior, dispositivos DCS-5010 con firmware 1.14.09 y anterior y dispositivos DCS-5020L con firmware anterior a 1.15.01, la inyección de comandos en alphapd (binario responsable de ejecutar el servidor web de la cámara) permite que los atacantes remotos autenticados ejecuten código al pasar entradas saneadas de usuario /setSystemAdmin en el campo AdminID directamente a una llamada al sistema. • https://www.exploit-db.com/exploits/44580 http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10084 https://www.fidusinfosec.com/dlink-dcs-5030l-remote-code-execution-cve-2017-17020 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 62EXPL: 2CVE-2017-7852 – D-Link DCS Series Cameras - Insecure Crossdomain
https://notcve.org/view.php?id=CVE-2017-7852
D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to *, thus accepting requests from any domain. If a victim logged into the camera's web console visits a malicious site hosting a malicious Flash file from another Browser tab, the malicious Flash file then can send requests to the victim's DCS series Camera without knowing the credentials. An attacker can host a malicious Flash file that can retrieve Live Feeds or information from the victim's DCS series Camera, add new admin users, or make other changes to the device. Known affected devices are DCS-933L with firmware before 1.13.05, DCS-5030L, DCS-5020L, DCS-2530L, DCS-2630L, DCS-930L, DCS-932L, and DCS-932LB1. • https://www.exploit-db.com/exploits/42074 https://www.qualys.com/2017/02/22/qsa-2017-02-22/qsa-2017-02-22.pdf • CWE-352: Cross-Site Request Forgery (CSRF) •