CVSS: 10.0EPSS: 96%CPEs: 62EXPL: 1CVE-2014-8361 – Realtek SDK Improper Input Validation Vulnerability
https://notcve.org/view.php?id=CVE-2014-8361
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023. El servicio miniigd SOAP en Realtek SDK permite a atacantes remotos ejecutar código arbitrario a través de una solicitud NewInternalClient manipulada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Realtek SDK. Authentication is not required to exploit this vulnerability. The specific flaw exists within the miniigd SOAP service. The issue lies in the handling of the NewInternalClient requests due to a failure to sanitize user data before executing a system call. • https://www.exploit-db.com/exploits/37169 http://jvn.jp/en/jp/JVN47580234/index.html http://jvn.jp/en/jp/JVN67456944/index.html http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055 http://www.securityfocus.com/bid/74330 http://www.zerodayinitiative.com/advisories/ZDI-15-155 https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos https://web.archive.org/web/20150909230440/ •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2009-4821
https://notcve.org/view.php?id=CVE-2009-4821
The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to (1) change the admin password via the admin_password parameter, (2) disable the security requirement for the Wi-Fi network via unspecified vectors, or (3) modify DNS settings via unspecified vectors. El D-Link DIR-615 con firmware 3.10NA no requiere autenticación de administrador para apply.cgi, lo que permite a atacantes remotos (1) cambiar la contraseña de administrador a través del parámetro "admin_password", (2) deshabilitar el requerimiento de seguridad para la red Wi-Fi mediante vectores no especificados o (3) modificar la configuración DNS mediante vectores no especificados. • http://secunia.com/advisories/37777 http://www.hiredhacker.com/2009/12/15/d-link-dir-615-remote-exploit http://www.securityfocus.com/bid/37415 • CWE-287: Improper Authentication •