CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-43622 – D-Link DIR-1935 HNAP_AUTH Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-43622
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Login requests to the web management portal. When parsing the HNAP_AUTH header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310 https://www.zerodayinitiative.com/advisories/ZDI-22-1491 • CWE-121: Stack-based Buffer Overflow •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-43619 – D-Link DIR-1935 ConfigFileUpload Format String Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-43619
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of ConfigFileUpload requests to the web management portal. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of root. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310 https://www.zerodayinitiative.com/advisories/ZDI-22-1493 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-43620 – D-Link DIR-1935 HNAP PrivateLogin Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-43620
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310 https://www.zerodayinitiative.com/advisories/ZDI-22-1494 • CWE-287: Improper Authentication •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-43633 – D-Link DIR-1935 SetSysLogSettings IPAddress Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-43633
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetSysLogSettings requests to the web management portal. When parsing the IPAddress element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310 https://www.zerodayinitiative.com/advisories/ZDI-22-1505 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-43628 – D-Link DIR-1935 SetIPv6FirewallSettings IPv6FirewallRule Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-43628
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetIPv6FirewallSettings requests to the web management portal. When parsing subelements within the IPv6FirewallRule element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310 https://www.zerodayinitiative.com/advisories/ZDI-22-1499 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •