Dlink
Page 14 of 18 — Dlink CVEs from a corpus of 1765, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39615 | Critical | 9.8 | 2021-08-23 | D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the… |
CVE-2021-39614 | Critical | 9.8 | 2021-08-23 | D-Link DVX-2000MS contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As weak passwords have been used, the plaintext pas… |
CVE-2021-39613 | Critical | 9.8 | 2021-08-23 | D-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As wea… |
CVE-2021-3708 | High | 7.8 | 2021-08-16 | D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. An unauthenticated attacker on the local network may exp… |
CVE-2021-3707 | Medium | 5.5 | 2021-08-16 | D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modification. An unauthenticated attacker on the lo… |
CVE-2021-29296 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vulnerability could be… |
CVE-2021-29295 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via usr/bin/lighttpd. I… |
CVE-2021-29294 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK_1.01, which could let a remove malicious user cause a denial of service via the send_hnap_… |
CVE-2021-28840 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074… |
CVE-2021-28839 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074… |
CVE-2021-28838 | High | 7.5 | 2021-08-10 | Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, DAP-2660 1.15rc131b… |
CVE-2021-37388 | Critical | 9.8 | 2021-08-06 | A buffer overflow in D-Link DIR-615 C2 3.03WW. The ping_ipaddr parameter in ping_response.cgi POST request allows an attacker to crash the webserver and might… |
CVE-2021-21820 | Critical | 9.8 | 2021-07-16 | A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lea… |
CVE-2021-21819 | High | 7.2 | 2021-07-16 | A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to… |
CVE-2021-21818 | High | 7.5 | 2021-07-16 | A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can le… |
CVE-2021-21817 | High | 7.5 | 2021-07-16 | An information disclosure vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request ca… |
CVE-2021-21816 | Medium | 4.3 | 2021-07-16 | An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disc… |
CVE-2021-34830 | High | 8.8 | 2021-07-15 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authenticatio… |
CVE-2021-34829 | High | 8.8 | 2021-07-15 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authenticatio… |
CVE-2021-34828 | High | 8.8 | 2021-07-15 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authenticatio… |
CVE-2021-34827 | High | 8.8 | 2021-07-15 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authenticatio… |
CVE-2021-33346 | Critical | 9.8 | 2021-06-24 | There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password o… |
CVE-2021-34204 | Medium | 6.8 | 2021-06-16 | D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text… |
CVE-2021-34203 | High | 8.1 | 2021-06-16 | D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of… |
CVE-2021-34201 | High | 7.1 | 2021-06-16 | D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Loc… |
CVE-2021-34202 | High | 7.8 | 2021-06-16 | There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permissions can be elevated to administrator pe… |
CVE-2020-29324 | High | 7.5 | 2021-06-04 | The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthentica… |
CVE-2020-29323 | High | 7.5 | 2021-06-04 | The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an un… |
CVE-2020-29322 | High | 7.5 | 2021-06-04 | The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2020-29321 | High | 7.5 | 2021-06-04 | The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2021-27342 | Medium | 5.9 | 2021-05-17 | An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumve… |
CVE-2021-20697 | Critical | 9.8 | 2021-04-26 | Missing authentication for critical function in DAP-1880AC firmware version 1.21 and earlier allows a remote attacker to login to the device as an authenticate… |
CVE-2021-20696 | High | 8.8 | 2021-04-26 | DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to execute arbitrary OS commands by sending a specially crafted request to… |
CVE-2021-20695 | High | 8.8 | 2021-04-26 | Improper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to ga… |
CVE-2021-20694 | High | 8.8 | 2021-04-26 | Improper access control vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to bypass access restriction and t… |
CVE-2021-27250 | Medium | 6.5 | 2021-04-14 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access poi… |
CVE-2021-27249 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Aut… |
CVE-2021-27248 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Aut… |
CVE-2021-27114 | Critical | 9.8 | 2021-04-14 | An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'… |
CVE-2021-27113 | Critical | 9.8 | 2021-04-14 | An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of… |
CVE-2021-29379 | High | 8.8 | 2021-04-12 | An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perfor… |
CVE-2020-27600 | Critical | 9.8 | 2021-04-02 | HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metac… |
CVE-2021-30072 | Critical | 9.8 | 2021-04-02 | An issue was discovered in prog.cgi on D-Link DIR-878 1.30B08 devices. Because strcat is misused, there is a stack-based buffer overflow that does not require… |
CVE-2021-26810 | Critical | 9.8 | 2021-03-30 | D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handl… |
CVE-2021-28143 | High | 8.0 | 2021-03-11 | /jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools). |
CVE-2021-28144 | High | 8.8 | 2021-03-11 | prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVi… |
CVE-2020-27865 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi exten… |
CVE-2020-27864 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi exten… |
CVE-2020-27863 | Medium | 6.5 | 2021-02-12 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Auth… |
CVE-2020-27862 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authenticati… |
CVE-2020-18568 | Critical | 9.8 | 2021-02-02 | The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability, which can cause remote command execution. |
CVE-2020-25506 | Critical | 9.8 | 2021-02-02 | D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution. |
CVE-2020-29557 | Critical | 9.8 | 2021-01-29 | An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-au… |
CVE-2021-3182 | High | 8.0 | 2021-01-19 | D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer supported by the maintainer |
CVE-2020-24577 | High | 7.5 | 2021-01-08 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such… |
CVE-2019-12768 | Critical | 9.8 | 2020-12-30 | An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass authentication via forceful browsing. |
CVE-2020-24581 | High | 8.0 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It contains an execute_cmd.cgi feature (that is not reachable v… |
CVE-2020-24580 | High | 7.5 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. Lack of authentication functionality allows an attacker to assi… |
CVE-2020-24579 | High | 8.8 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to acce… |
CVE-2020-24578 | Medium | 6.5 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious netw… |
CVE-2020-25759 | High | 8.8 | 2020-12-15 | An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacke… |
CVE-2020-25758 | High | 8.8 | 2020-12-15 | An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to… |
CVE-2020-25757 | High | 8.8 | 2020-12-15 | A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulti… |
CVE-2020-26567 | Medium | 5.5 | 2020-10-08 | An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed without authentication. Any access rebo… |
CVE-2020-26582 | High | 8.8 | 2020-10-06 | D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON value for ping (ak… |
CVE-2020-25786 | Medium | 6.1 | 2020-09-19 | webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects… |
CVE-2018-20432 | Critical | 9.8 | 2020-09-14 | D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use hardcoded credentials for telnet connection, which allows unauthenticated attackers to gain privil… |
CVE-2020-25079 | High | 8.8 | 2020-09-02 | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injecti… |
CVE-2020-25078 | High | 7.5 | 2020-09-02 | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for r… |
CVE-2019-6258 | Critical | 9.8 | 2020-08-18 | D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo HNAP protocol messa… |
CVE-2020-15633 | High | 8.8 | 2020-07-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi… |
CVE-2020-15632 | High | 8.8 | 2020-07-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is no… |
CVE-2020-15631 | High | 8.0 | 2020-07-23 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03_HOTFIX WiFi extenders. Alth… |
CVE-2020-15896 | High | 7.5 | 2020-07-22 | An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any… |
CVE-2020-15895 | Medium | 6.1 | 2020-07-22 | An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT… |
CVE-2020-15894 | High | 7.5 | 2020-07-22 | An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used t… |
CVE-2020-15893 | Critical | 9.8 | 2020-07-22 | An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can… |
CVE-2020-15892 | Critical | 9.8 | 2020-07-22 | An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the reque… |
CVE-2020-12774 | High | 8.2 | 2020-07-22 | D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command. |
CVE-2020-9377 | High | 8.8 | 2020-07-09 | D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer s… |
CVE-2020-9376 | High | 7.5 | 2020-07-09 | D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects produ… |
CVE-2020-13150 | High | 7.8 | 2020-06-15 | D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately 90 seconds of access to the control panel, after a restart, before MAC address filtering rules be… |
CVE-2020-13960 | High | 7.5 | 2020-06-08 | D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, which allows remote att… |
CVE-2020-12695 | High | 7.5 | 2020-06-08 | The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a differe… |
CVE-2020-13787 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information. |
CVE-2020-13786 | High | 8.8 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF. |
CVE-2020-13785 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength. |
CVE-2020-13784 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator. |
CVE-2020-13783 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information. |
CVE-2020-13782 | High | 8.8 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection. |
CVE-2020-13136 | High | 7.5 | 2020-05-18 | D-Link DSP-W215 1.26b03 devices send an obfuscated hash that can be retrieved and understood by a network sniffer. |
CVE-2020-13135 | Medium | 6.5 | 2020-05-18 | D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstrated by a Squid Proxy. |
CVE-2019-18666 | Critical | 9.8 | 2020-05-15 | An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP reque… |
CVE-2019-17525 | High | 8.8 | 2020-04-21 | The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks. |
CVE-2020-9279 | Critical | 9.8 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in use… |
CVE-2020-9278 | Critical | 9.1 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The device can be reset to its default configuration by accessing an unauthenticated URL. |
CVE-2020-9277 | Critical | 9.8 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administ… |
CVE-2020-9276 | High | 8.8 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The function do_cgi(), which processes cgi requests supplied to the device's web servers, is v… |
CVE-2020-9275 | Critical | 9.8 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A cfm UDP service listening on port 65002 allows remote, unauthenticated exfiltration of admin… |
CVE-2020-6765 | High | 7.2 | 2020-04-10 | D-Link DSL-GS225 J1 AU_1.0.4 devices allow an admin to execute OS commands by placing shell metacharacters after a supported CLI command, as demonstrated by pi… |