CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8312
https://notcve.org/view.php?id=CVE-2019-8312
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysLogSettings API function, as demonstrated by shell metacharacters in the IPAddress field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/syslog.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8315
https://notcve.org/view.php?id=CVE-2019-8315
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv4FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv4AddressRangeStart field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv4.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8313
https://notcve.org/view.php?id=CVE-2019-8313
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv6FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv6AddressRangeStart field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv6.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8319
https://notcve.org/view.php?id=CVE-2019-8319
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv4Settings API function, as demonstrated by shell metacharacters in the Gateway field. Se ha descubierto un problema en dispositivos D-Link DIR-878 con firmware en su versión 1.12A1. • https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv4.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •