CVSS: 8.8EPSS: 11%CPEs: 6EXPL: 0CVE-2020-8864 – D-Link Multiple Routers HNAP strncmp Incorrect Comparison Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-8864
24 Feb 2020 — This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can leverage this vulnerability to execute arbitrary code on the router. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157 • CWE-697: Incorrect Comparison •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-9124
https://notcve.org/view.php?id=CVE-2019-9124
25 Feb 2019 — An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password. Se ha descubierto un problema en dispositivos D-Link DIR-878 1.12B01. En el URI /HNAP1, un atacante puede iniciar sesión con una contraseña en blanco. • https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-878/blankpassword.md • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 2CVE-2019-9125
https://notcve.org/view.php?id=CVE-2019-9125
25 Feb 2019 — An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not require authentication via the HNAP_AUTH HTTP header. Se ha descubierto un problema en dispositivos D-Link DIR-878 1.12B01. Debido a que strncpy se emplea de manera incorrecta, hay una vulnerabilidad de desbordamiento de búfer basada en pila que no requiere autenticación mediante la cabecera HNAP_AUTH HTTP. • https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-878/overflow1.md • CWE-306: Missing Authentication for Critical Function CWE-787: Out-of-bounds Write •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 1CVE-2019-8314
https://notcve.org/view.php?id=CVE-2019-8314
13 Feb 2019 — An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddr... • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/qos.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 1CVE-2019-8312
https://notcve.org/view.php?id=CVE-2019-8312
13 Feb 2019 — An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysLogSettings API function, as demonstrated by shell metacharacters in the I... • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/syslog.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 1CVE-2019-8313
https://notcve.org/view.php?id=CVE-2019-8313
13 Feb 2019 — An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv6FirewallSettings API function, as demonstrated by shell metacharacters in... • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv6.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 1CVE-2019-8317
https://notcve.org/view.php?id=CVE-2019-8317
13 Feb 2019 — An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters i... • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv6.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 1CVE-2019-8315
https://notcve.org/view.php?id=CVE-2019-8315
13 Feb 2019 — An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv4FirewallSettings API function, as demonstrated by shell metacharacters in... • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv4.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 1CVE-2019-8316
https://notcve.org/view.php?id=CVE-2019-8316
13 Feb 2019 — An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWebFilterSettings API function, as demonstrated by shell metacharacters in the ... • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/webfilter.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 1CVE-2019-8318
https://notcve.org/view.php?id=CVE-2019-8318
13 Feb 2019 — An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the... • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/mail.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •