CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-40718 – D-Link DIR-2150 anweb websocket_data_handler Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-40718
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304 https://www.zerodayinitiative.com/advisories/ZDI-22-1221 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-40719 – D-Link DIR-2150 xupnpd_generic Plugin Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-40719
This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd_generic.lua plugin for the xupnpd service, which listens on TCP port 4044 by default. When parsing the feed parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304 https://www.zerodayinitiative.com/advisories/ZDI-22-1223 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 1CVE-2022-38258
https://notcve.org/view.php?id=CVE-2022-38258
A local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service (DoS) or access sensitive server information via manipulation of the getpage parameter in a crafted web request. Una vulnerabilidad de inclusión de archivos locales (LFI) en D-Link DIR 819 versión v1.06, permite a atacantes provocar una Denegación de Servicio (DoS) o acceder a información confidencial del servidor mediante la manipulación del parámetro getpage en una petición web manipulada • https://whokilleddb.github.io/blogs/posts/dlink_dir-819_lfi_and_dos https://www.dlink.com/en/security-bulletin • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36588
https://notcve.org/view.php?id=CVE-2022-36588
In D-Link DAP1650 v1.04 firmware, the fileaccess.cgi program in the firmware has a buffer overflow vulnerability caused by strncpy. En el firmware D-Link DAP1650 versiones v1.04, el programa fileaccess.cgi en el firmware presenta una vulnerabilidad de desbordamiento de búfer causada por strncpy • https://github.com/Davidteeri/Bug-Report/blob/main/dlink-dap1650-0x419EF8.md https://support.dlink.com/ProductInfo.aspx?m=DAP-1650 https://www.dlink.com/en/security-bulletin • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31414
https://notcve.org/view.php?id=CVE-2022-31414
D-Link DIR-1960 firmware DIR-1960_A1_1.11 was discovered to contain a buffer overflow via srtcat in prog.cgi. This vulnerability allowed attackers to cause a Denial of Service (DoS) via a crafted HTTP request. Se ha detectado que el firmware DIR-1960_A1_1.11 de D-Link contiene un desbordamiento de búfer por medio de srtcat en el archivo prog.cgi. Esta vulnerabilidad permitía a atacantes causar una denegación de servicio (DoS) por medio de una petición HTTP diseñada • https://github.com/Davidteeri/Bug-Report/blob/main/dlink-dir1960-%200x42acdc.md https://tsd.dlink.com.tw/ddgo https://www.dlink.com/en/security-bulletin • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •