Vulnerabilities

TI-2024-00708 CVE-2024-0769 · GHSA-w828-74x3-f6hx

D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal

CRITICAL 100KEV

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.82714 Published 2024-01-21 No fix listed CWE-22

TI-2023-18113 CVE-2023-36092 · GHSA-29mx-8r38-hfxq

Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to…

MEDIUM 46

Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01654 Published 2023-07-31 No fix listed CWE-863

TI-2022-08844 CVE-2022-25106 · GHSA-wjq5-hxjh-57xx

D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the…

LOW 36

D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.08588 Published 2022-03-04 No fix listed CWE-787

TI-2019-14577 CVE-2019-20217 · GHSA-rm3g-gj58-gg6q

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute…

MEDIUM 48

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03558 Published 2020-01-29 No fix listed CWE-78

TI-2019-14576 CVE-2019-20216 · GHSA-v9mx-483f-5528

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute…

MEDIUM 48

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03673 Published 2020-01-29 No fix listed CWE-78

TI-2019-14575 CVE-2019-20215 · GHSA-xj55-9jj5-7q99

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute…

HIGH 81

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.75105 Published 2020-01-29 No fix listed CWE-78

TI-2019-14574 CVE-2019-20213 · GHSA-c2wf-4gpc-mpwc

D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure…

LOW 37

D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02181 Published 2020-01-02 No fix listed CWE-74

TI-2019-13149 CVE-2019-17621 · GHSA-4cjx-47hq-7hc2

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01…

CRITICAL 100KEV

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE reque…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.90615 Published 2019-12-30 No fix listed CWE-78

Vulnerabilities

Filters