CVSS: 8.0EPSS: 0%CPEs: 4EXPL: 0CVE-2021-41504
https://notcve.org/view.php?id=CVE-2021-41504
An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. The use of the digest-authentication for the devices command interface may allow further attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Un problema de privilegios elevados se presenta en D-Link DCS-5000L versión v1.05 y DCS-932L versión v2.17 y anteriores. El uso de la autenticación digest para la interfaz de comandos de los dispositivos puede permitir otros vectores de ataque que pueden comprometer la configuración de las cámaras y permitir que usuarios maliciosos en la LAN accedan al dispositivo. NOTA: Esta vulnerabilidad sólo afecta a los productos que ya no son soportados por el mantenedor. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10247 https://www.dlink.com/en/security-bulletin •
CVSS: 8.0EPSS: 0%CPEs: 4EXPL: 0CVE-2021-41503
https://notcve.org/view.php?id=CVE-2021-41503
DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer DCS-5000L versión v1.05 y DCS-932L versión v2.17 y anteriores, están afectados por un Control de Acceso Incorrecto. El uso de la autenticación básica para la interfaz de comandos de los dispositivos permite vectores de ataque que pueden comprometer la configuración de las cámaras y permitir que usuarios maliciosos en la LAN accedan al dispositivo. NOTA: Esta vulnerabilidad sólo afecta a los productos que ya no son soportados por el mantenedor. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10247 https://www.dlink.com/en/security-bulletin • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 20EXPL: 3CVE-2019-10999
https://notcve.org/view.php?id=CVE-2019-10999
The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The overflow allows a remotely authenticated attacker to execute arbitrary code by providing a long string in the WEPEncryption parameter when requesting wireless.htm. Vulnerable devices include DCS-5009L (1.08.11 and below), DCS-5010L (1.14.09 and below), DCS-5020L (1.15.12 and below), DCS-5025L (1.03.07 and below), DCS-5030L (1.04.10 and below), DCS-930L (2.16.01 and below), DCS-931L (1.14.11 and below), DCS-932L (2.17.01 and below), DCS-933L (1.14.11 and below), and DCS-934L (1.05.04 and below). Las series DCS de D-Link de cámaras Wi-Fi contienen una vulnerabilidad de desbordamiento de búfer basado en pila en alphapd, el servidor web de la cámara. El desbordamiento permite a un atacante autenticado de forma remota ejecutar código arbitrario proporcionando una cadena larga en el parámetro WEPEncryption cuando solicita wireless.htm. • https://github.com/tacnetsol/CVE-2019-10999 https://github.com/qjh2333/CVE-2019-10999 https://github.com/fuzzywalls/CVE-2019-10999 https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10131 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 62EXPL: 2CVE-2017-7852 – D-Link DCS Series Cameras - Insecure Crossdomain
https://notcve.org/view.php?id=CVE-2017-7852
D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to *, thus accepting requests from any domain. If a victim logged into the camera's web console visits a malicious site hosting a malicious Flash file from another Browser tab, the malicious Flash file then can send requests to the victim's DCS series Camera without knowing the credentials. An attacker can host a malicious Flash file that can retrieve Live Feeds or information from the victim's DCS series Camera, add new admin users, or make other changes to the device. Known affected devices are DCS-933L with firmware before 1.13.05, DCS-5030L, DCS-5020L, DCS-2530L, DCS-2630L, DCS-930L, DCS-932L, and DCS-932LB1. • https://www.exploit-db.com/exploits/42074 https://www.qualys.com/2017/02/22/qsa-2017-02-22/qsa-2017-02-22.pdf • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2012-4046
https://notcve.org/view.php?id=CVE-2012-4046
The D-Link DCS-932L camera with firmware 1.02 allows remote attackers to discover the password via a UDP broadcast packet, as demonstrated by running the D-Link Setup Wizard and reading the _paramR["P"] value. La cámara D-Link DCS-932L con firmware v1.02 permite a atacantes remotos descubrir la contraseña a través de un paquete de difusión UDP, tal y como se demuestra mediante la ejecución del Asistente para Configuración de D-Link y la lectura posterior del valor de _paramR ["P"]. • http://seclists.org/bugtraq/2012/Dec/98 http://www.fishnetsecurity.com/6labs/blog/password-disclosure-d-link-surveillance-cameras-cve-2012-4046 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •