CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-9124
https://notcve.org/view.php?id=CVE-2019-9124
An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password. Se ha descubierto un problema en dispositivos D-Link DIR-878 1.12B01. En el URI /HNAP1, un atacante puede iniciar sesión con una contraseña en blanco. • https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-878/blankpassword.md • CWE-287: Improper Authentication •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8316
https://notcve.org/view.php?id=CVE-2019-8316
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWebFilterSettings API function, as demonstrated by shell metacharacters in the WebFilterURLs field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/webfilter.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8318
https://notcve.org/view.php?id=CVE-2019-8318
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the SMTPServerPort field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/mail.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8317
https://notcve.org/view.php?id=CVE-2019-8317
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters in the DestNetwork field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv6.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8314
https://notcve.org/view.php?id=CVE-2019-8314
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/qos.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •