Dir-822 Firmware vulnerabilities
8 known vulnerabilities in Dir-822 Firmware from D-Link. 8 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.3 High severity
DIR-822: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in D-Link DIR-822 A_101. The impacted element is the function system of the file /udhcpcd/dhcpd.c of the component udhcpd DHCP Service. This manipulation of the argument Hostname causes command injection. The attack can be initia
- 9.8 Critical severity
dir-822: Improper Neutralization of Special Elements used in a Command
D-Link DIR-822+ V1.0.5 was found to contain a command injection in ftext function of upload_firmware.cgi, which allows remote attackers to execute arbitrary commands via shell.
- 8.8 High severity
dir-822_firmware: Improper Neutralization of Special Elements used in an OS Command
D-Link DIR-822+ V1.0.5 was found to contain a command injection in ChgSambaUserSettings function of prog.cgi, which allows remote attackers to execute arbitrary commands via shell.
- 7.5 High severity
dir-822: Improper Neutralization of Special Elements used in a Command
D-Link DIR-822+ V1.0.5 was found to contain a command injection in SetPlcNetworkpwd function of prog.cgi, which allows remote attackers to execute arbitrary commands via shell.
- 9.3 Critical severity
dir-822_firmware: Stack-based Buffer Overflow
DIR-822 Rev. B Firmware v2.02KRB09 and DIR-822-CA Rev. B Firmware v2.03WWb01 suffer from a LAN-Side Unauthenticated Remote Code Execution (RCE) vulnerability elevated from HNAP Stack-Based Buffer Overflow.
- 9.8 Critical severity
Dir-822 Firmware: Missing Authentication for Critical Functionality
D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with empty passwords.
- 9.8 Critical severity
Dir-822 Firmware: Improper Neutralization of Special Elements used in an OS Command
D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. allows remote attackers to execute arbitrary commands via shell.
- 9.8 Critical severity
D-Link DIR-859 Router Command Execution Exploited
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting t