Dlink
Page 17 of 18 — Dlink CVEs from a corpus of 1765, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-15874 | Medium | 6.1 | 2018-08-25 | Cross-site scripting (XSS) vulnerability on D-Link DIR-615 routers 20.07 allows an attacker to inject JavaScript into the "Status -> Active Client Table" page… |
CVE-2017-11564 | High | 8.8 | 2018-08-24 | The D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has multiple command injection vulnerabilities in the web service framework. An attacker can forge malicious HT… |
CVE-2017-11563 | Critical | 9.8 | 2018-08-24 | D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has a remote code execution vulnerability. A UDP "Discover" service, which provides multiple functions such as chan… |
CVE-2016-6563 | Critical | 9.8 | 2018-07-13 | Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML f… |
CVE-2018-12103 | Medium | 6.5 | 2018-07-05 | An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with fir… |
CVE-2018-6213 | Critical | 9.8 | 2018-06-20 | In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there… |
CVE-2018-6212 | Medium | 6.1 | 2018-06-20 | On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, a reflected Cross-Site… |
CVE-2018-6211 | High | 7.2 | 2018-06-20 | On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, OS command injection is… |
CVE-2018-6210 | Critical | 9.8 | 2018-06-19 | D-Link DIR-620 devices, with a certain Rostelekom variant of firmware 1.0.37, have a hardcoded rostel account, which makes it easier for remote attackers to ob… |
CVE-2018-8898 | Critical | 9.8 | 2018-05-23 | A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616… |
CVE-2018-10968 | Critical | 9.8 | 2018-05-18 | On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to get unauthorized access to vulnerable devices, ak… |
CVE-2018-10967 | High | 8.8 | 2018-05-18 | On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can forge an HTTP request to inject operating system commands that can be executed on… |
CVE-2018-11013 | Critical | 9.8 | 2018-05-13 | Stack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN) routers with firmware version 1.10B05 allows unauthenticated remo… |
CVE-2018-10957 | High | 8.8 | 2018-05-10 | CSRF exists on D-Link DIR-868L devices, leading to (for example) a change to the Admin password. hedwig.cgi and pigwidgeon.cgi are two of the affected componen… |
CVE-2018-10750 | High | 8.8 | 2018-05-04 | An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'staticGet' parameter to the '/userfs/bin/tcapi'… |
CVE-2018-10749 | High | 8.8 | 2018-05-04 | An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'commit' parameter to the '/userfs/bin/tcapi' bin… |
CVE-2018-10748 | High | 8.8 | 2018-05-04 | An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'show' parameter to the '/userfs/bin/tcapi' binar… |
CVE-2018-10747 | High | 8.8 | 2018-05-04 | An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as an 'unset' parameter to the '/userfs/bin/tcapi' bin… |
CVE-2018-10746 | High | 8.8 | 2018-05-04 | An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'get' parameter to the '/userfs/bin/tcapi' binary… |
CVE-2018-10641 | High | 8.1 | 2018-05-04 | D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext. |
CVE-2018-10713 | High | 8.8 | 2018-05-03 | An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'read' parameter to the '/userfs/bin/tcapi' binar… |
CVE-2017-17020 | High | 8.8 | 2018-05-01 | On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DCS-5020L devices with firmware before 1… |
CVE-2018-10431 | High | 7.2 | 2018-04-26 | D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen. |
CVE-2018-10110 | Medium | 4.8 | 2018-04-18 | D-Link DIR-615 T1 devices allow XSS via the Add User feature. |
CVE-2018-10108 | Medium | 6.1 | 2018-04-16 | D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webinc/js/bsc_sms_inbox… |
CVE-2018-10107 | Medium | 6.1 | 2018-04-16 | D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php. |
CVE-2018-10106 | Critical | 9.8 | 2018-04-16 | D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have permission bypass and information disclosure in /htdocs/web/get… |
CVE-2015-0153 | High | 7.5 | 2018-04-12 | D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the wireless key. |
CVE-2015-0152 | Critical | 9.8 | 2018-04-12 | D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the administrati… |
CVE-2015-0151 | High | 8.8 | 2018-04-12 | Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of… |
CVE-2015-0150 | Critical | 9.8 | 2018-04-12 | The remote administration UI in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to bypass intended access restrictions via unspeci… |
CVE-2014-8888 | Critical | 9.8 | 2018-04-12 | The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to execute arbitrary commands via vectors r… |
CVE-2018-9284 | Critical | 9.8 | 2018-04-04 | authentication.cgi on D-Link DIR-868L devices with Singapore StarHub firmware before v1.21SHCb03 allows remote attackers to execute arbitrary code. |
CVE-2018-8941 | High | 8.8 | 2018-04-03 | Diagnostics functionality on D-Link DSL-3782 devices with firmware EU v. 1.01 has a buffer overflow, allowing authenticated remote attackers to execute arbitra… |
CVE-2018-5708 | High | 8.0 | 2018-03-30 | An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a use… |
CVE-2018-9032 | Critical | 9.8 | 2018-03-27 | An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmware Version : 1.02-2… |
CVE-2018-6530 | Critical | 9.8 | 2018-03-06 | OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L… |
CVE-2018-6529 | Medium | 6.1 | 2018-03-06 | XSS vulnerability in htdocs/webinc/js/bsc_sms_inbox.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08… |
CVE-2018-6528 | Medium | 6.1 | 2018-03-06 | XSS vulnerability in htdocs/webinc/body/bsc_sms_send.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.0… |
CVE-2018-6527 | Medium | 6.1 | 2018-03-06 | XSS vulnerability in htdocs/webinc/js/adv_parent_ctrl_map.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATC… |
CVE-2018-6936 | Medium | 5.4 | 2018-02-21 | Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account. |
CVE-2018-5371 | High | 8.8 | 2018-01-12 | diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers… |
CVE-2017-3193 | High | 8.8 | 2017-12-16 | Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overflow vulnerability in the web administra… |
CVE-2017-3192 | Critical | 9.8 | 2017-12-16 | D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page disclose… |
CVE-2017-3191 | Critical | 9.8 | 2017-12-16 | D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that… |
CVE-2017-17065 | High | 7.5 | 2017-11-30 | An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06_hbrf devices, related to the code that handles the authentication values for HNAP. An a… |
CVE-2017-7851 | High | 8.8 | 2017-11-15 | D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of th… |
CVE-2017-16765 | Medium | 6.1 | 2017-11-10 | XSS exists on D-Link DWR-933 1.00(WW)B17 devices via cgi-bin/gui.cgi. |
CVE-2016-10699 | Medium | 6.1 | 2017-10-31 | D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logi… |
CVE-2017-15909 | Critical | 9.8 | 2017-10-26 | D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell access. |
CVE-2015-1187 | Critical | 9.8 | 2017-09-21 | The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. |
CVE-2017-14430 | High | 7.5 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allow remote attackers to cause a de… |
CVE-2017-14429 | Critical | 9.8 | 2017-09-13 | The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenti… |
CVE-2017-14428 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/hostapd* permissi… |
CVE-2017-14427 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/storage_account_r… |
CVE-2017-14426 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0644 /var/etc/shadow (aka the /… |
CVE-2017-14425 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/etc/hnapasswd permiss… |
CVE-2017-14424 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/passwd permissions. |
CVE-2017-14423 | High | 7.5 | 2017-09-13 | htdocs/parentalcontrols/bind.php on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices does not prevent unauthenticated nonce-guessin… |
CVE-2017-14422 | High | 7.5 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded /etc/stunnel… |
CVE-2017-14421 | Critical | 9.8 | 2017-09-13 | D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices have a hardcoded password of wrgac25_dlink.2013gui_dir850l for the Alphanetworks account upon… |
CVE-2017-14420 | Medium | 5.9 | 2017-09-13 | The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devic… |
CVE-2017-14419 | Medium | 5.9 | 2017-09-13 | The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devic… |
CVE-2017-14418 | High | 8.1 | 2017-09-13 | The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices, sends the cleartext admin password o… |
CVE-2017-14417 | Critical | 9.8 | 2017-09-13 | register_send.php on D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices does not require authentication, which can result in unintended enrollme… |
CVE-2017-14416 | Medium | 6.1 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/wandetect.php. |
CVE-2017-14415 | Medium | 6.1 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/sitesurvey.php. |
CVE-2017-14414 | Medium | 6.1 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/shareport.php. |
CVE-2017-14413 | Medium | 6.1 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/wpsacts.php. |
CVE-2016-10405 | Critical | 9.8 | 2017-09-07 | Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecif… |
CVE-2014-7860 | Medium | 5.3 | 2017-08-25 | The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows rem… |
CVE-2014-7859 | Critical | 9.8 | 2017-08-25 | Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-326 before 2.10 build… |
CVE-2014-7858 | Critical | 9.8 | 2017-08-25 | The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie para… |
CVE-2014-7857 | Critical | 9.8 | 2017-08-25 | D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2… |
CVE-2017-12943 | Critical | 9.8 | 2017-08-18 | D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal att… |
CVE-2017-10676 | Medium | 6.1 | 2017-07-20 | On D-Link DIR-600M devices before C1_v3.05ENB01_beta_20170306, XSS was found in the form2userconfig.cgi username parameter. |
CVE-2017-11436 | Critical | 9.8 | 2017-07-19 | D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access via a TELNET connec… |
CVE-2017-7406 | Critical | 9.8 | 2017-07-07 | The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certif… |
CVE-2017-7405 | Critical | 9.8 | 2017-07-07 | On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP addres… |
CVE-2017-7404 | High | 8.8 | 2017-07-07 | On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious s… |
CVE-2017-9675 | High | 7.5 | 2017-06-15 | On D-Link DIR-605L devices, firmware before 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot. |
CVE-2017-9542 | Critical | 9.8 | 2017-06-11 | D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the… |
CVE-2017-9100 | High | 8.8 | 2017-05-21 | login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password… |
CVE-2015-7247 | Critical | 9.8 | 2017-04-24 | D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) i… |
CVE-2015-7246 | Critical | 9.8 | 2017-04-24 | D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which mak… |
CVE-2015-7245 | High | 7.5 | 2017-04-24 | Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive informati… |
CVE-2017-7852 | High | 8.8 | 2017-04-24 | D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings vi… |
CVE-2016-1559 | High | 8.1 | 2017-04-21 | D-Link DAP-1353 H/W vers. B1 3.15 and earlier, D-Link DAP-2553 H/W ver. A1 1.31 and earlier, and D-Link DAP-3520 H/W ver. A1 1.16 and earlier reveal wireless p… |
CVE-2016-1558 | Critical | 9.8 | 2017-04-21 | Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver. B1 3.05 and earlier, DAP-2660 1.11… |
CVE-2017-6190 | High | 7.5 | 2017-04-10 | Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary fil… |
CVE-2017-7398 | High | 8.8 | 2017-04-04 | D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacker to perform an unwanted action on a wi… |
CVE-2017-5874 | High | 8.8 | 2017-03-22 | CSRF exists on D-Link DIR-600M Rev. Cx devices before v3.05ENB01_beta_20170306. This can be used to bypass authentication and insert XSS sequences or possibly… |
CVE-2017-6411 | High | 8.8 | 2017-03-06 | Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or firewall configuration or any password. |
CVE-2017-5633 | High | 8.0 | 2017-03-06 | Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to (1) change the adm… |
CVE-2017-6206 | High | 7.5 | 2017-02-23 | D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allo… |
CVE-2017-6205 | Critical | 9.8 | 2017-02-23 | D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allo… |
CVE-2016-10186 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. /var/miniupnpd.conf has no deny rules. |
CVE-2016-10185 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. A secure_mode=no line exists in /var/miniupnpd.conf. |
CVE-2016-10184 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb allows file reading with ..%2f traversal. |
CVE-2016-10183 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb allows directory listing with ../ traversal. |