CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 2CVE-2019-9125
https://notcve.org/view.php?id=CVE-2019-9125
An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not require authentication via the HNAP_AUTH HTTP header. Se ha descubierto un problema en dispositivos D-Link DIR-878 1.12B01. Debido a que strncpy se emplea de manera incorrecta, hay una vulnerabilidad de desbordamiento de búfer basada en pila que no requiere autenticación mediante la cabecera HNAP_AUTH HTTP. • https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-878/overflow1.md https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-878/overflow2.md • CWE-306: Missing Authentication for Critical Function CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-9124
https://notcve.org/view.php?id=CVE-2019-9124
An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password. Se ha descubierto un problema en dispositivos D-Link DIR-878 1.12B01. En el URI /HNAP1, un atacante puede iniciar sesión con una contraseña en blanco. • https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-878/blankpassword.md • CWE-287: Improper Authentication •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8316
https://notcve.org/view.php?id=CVE-2019-8316
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWebFilterSettings API function, as demonstrated by shell metacharacters in the WebFilterURLs field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/webfilter.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8318
https://notcve.org/view.php?id=CVE-2019-8318
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the SMTPServerPort field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/mail.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8317
https://notcve.org/view.php?id=CVE-2019-8317
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters in the DestNetwork field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv6.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •