CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8318
https://notcve.org/view.php?id=CVE-2019-8318
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the SMTPServerPort field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/mail.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8317
https://notcve.org/view.php?id=CVE-2019-8317
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters in the DestNetwork field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv6.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8314
https://notcve.org/view.php?id=CVE-2019-8314
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/qos.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8312
https://notcve.org/view.php?id=CVE-2019-8312
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysLogSettings API function, as demonstrated by shell metacharacters in the IPAddress field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/syslog.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8315
https://notcve.org/view.php?id=CVE-2019-8315
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv4FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv4AddressRangeStart field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv4.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •