Vulnerabilities

TI-2023-06031 CVE-2023-6580 · GHSA-r2mg-8788-h74v

D-Link DIR-846 QoS POST deserialization

MEDIUM 43

A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02347 Published 2023-12-07 No fix listed CWE-502

TI-2023-23172 CVE-2023-43284 · GHSA-pmfm-5ff8-2rf4

D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an…

HIGH 73

D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecified manipulation of the QoS POST parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02341 Published 2023-10-05 No fix listed

TI-2023-16660 CVE-2023-33735 · GHSA-fwc5-f8jq-qgh2

D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE)…

HIGH 82

D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1 interface.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.31557 Published 2023-05-31 No fix listed

TI-2022-23009 CVE-2022-46552 · GHSA-4mwq-46m8-4mgj

D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution…

HIGH 73

D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.10503 Published 2023-02-02 No fix listed CWE-78

TI-2022-23051 CVE-2022-46642 · GHSA-62xc-g7hf-p457

D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability…

MEDIUM 48

D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.03093 Published 2022-12-23 No fix listed CWE-77

TI-2022-23050 CVE-2022-46641 · GHSA-23qm-j98q-xr7j

D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability…

MEDIUM 48

D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIpMacBindSettings function.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.03093 Published 2022-12-23 No fix listed CWE-77

TI-2020-13969 CVE-2020-21016 · GHSA-6p9q-3fp4-ff53

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary…

HIGH 82

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02692 Published 2022-10-31 No fix listed CWE-94

TI-2021-21155 CVE-2021-46319 · GHSA-mq76-pcfx-jm9r

Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846…

MEDIUM 52

Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06573 Published 2022-02-17 No fix listed CWE-78

TI-2021-21154 CVE-2021-46315 · GHSA-cmfq-h2jx-ghxf

Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php…

MEDIUM 52

Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06573 Published 2022-02-17 No fix listed CWE-78

TI-2021-21153 CVE-2021-46314 · GHSA-hx39-4884-w52p

A Remote Command Execution (RCE) vulnerability exists in…

HIGH 67

A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.33287 Published 2022-02-17 No fix listed CWE-78

TI-2020-16717 CVE-2020-27600 · GHSA-j3v2-w597-rhpw

HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26…

MEDIUM 57

HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.13877 Published 2021-04-02 No fix listed CWE-78

TI-2019-13054 CVE-2019-17509 · GHSA-9r83-rpg5-r269

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary…

MEDIUM 48

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03484 Published 2019-10-11 No fix listed CWE-78

TI-2019-13055 CVE-2019-17510 · GHSA-9f67-jfh4-rv2j

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary…

MEDIUM 48

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squas…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03557 Published 2019-10-11 No fix listed CWE-78

Vulnerabilities

Filters