CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 1CVE-2023-25280 – D-Link DIR-820 Router OS Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2023-25280
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. • https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg https://www.dlink.com/en/security-bulletin • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-25281
https://notcve.org/view.php?id=CVE-2023-25281
A stack overflow vulnerability exists in pingV4Msg component in D-Link DIR820LA1_FW105B03, allows attackers to cause a denial of service via the nextPage parameter to ping.ccp. • https://github.com/migraine-sudo/D_Link_Vuln/tree/main/stackoverflow%20cancelPing https://www.dlink.com/en/security-bulletin • CWE-787: Out-of-bounds Write •