CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 1CVE-2019-7390
https://notcve.org/view.php?id=CVE-2019-7390
An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API. Se ha descubierto un problema en /bin/goahead en dispositivos D-Link DIR-823G con firmware en su versión 1.02B03. Hay un control de acceso incorrecto que permite que los atacantes remotos secuestren la configuración del servicio DNS de todos los clientes en la WLAN sin autenticación, mediante la API HNAP SetWanSettings. • http://www.securityfocus.com/bid/106855 https://github.com/leonW7/D-Link/blob/master/Vul_5.md • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.3EPSS: 71%CPEs: 2EXPL: 1CVE-2019-7298
https://notcve.org/view.php?id=CVE-2019-7298
An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body, such as a body of ' /bin/telnetd' for the GetDeviceSettingsset API function. Consequently, an attacker can execute any command remotely when they control this input. Se ha descubierto un problema en dispositivos D-Link DIR-823G con versiones de firmware hasta la 1.02B03. • http://www.securityfocus.com/bid/106814 https://github.com/leonW7/D-Link/blob/master/Vul_2.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 73%CPEs: 2EXPL: 1CVE-2019-7297
https://notcve.org/view.php?id=CVE-2019-7297
An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system function with an untrusted input parameter named Address. Consequently, an attacker can execute any command remotely when they control this input. Se ha descubierto un problema en dispositivos D-Link DIR-823G con firmware hasta la versión 1.02B03. • http://www.securityfocus.com/bid/106815 https://github.com/leonW7/D-Link/blob/master/Vul_1.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2018-17880
https://notcve.org/view.php?id=CVE-2018-17880
On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot. En dispositivos D-Link DIR-823G 2018-09-19, la configuración GoAhead permite comandos /HNAP1 RunReboot sin autenticación para desencadenar un reinicio. • https://xz.aliyun.com/t/2834#toc-5 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2018-17881
https://notcve.org/view.php?id=CVE-2018-17881
On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change. En dispositivos D-Link DIR-823G 2018-09-19, la configuración GoAhead permite comandos /HNAP1 SetPasswdSettings sin autenticación para desencadenar un cambio de contraseña de administrador. • https://xz.aliyun.com/t/2834#toc-5 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •