D-Link Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

DNS-32059 vulnerabilities
DAP-262254 vulnerabilities
DNS-32550 vulnerabilities
DNS-340L49 vulnerabilities
DNS-320LW48 vulnerabilities
DNS-320L47 vulnerabilities
DNS-327L47 vulnerabilities
DIR-605L46 vulnerabilities
DNR-322L45 vulnerabilities
DNS-34545 vulnerabilities
DNR-202L44 vulnerabilities
DNR-32644 vulnerabilities
DNS-1100-444 vulnerabilities
DNS-12044 vulnerabilities
DNS-1200-0544 vulnerabilities
DNS-1550-0444 vulnerabilities
DNS-315L44 vulnerabilities
DNS-32144 vulnerabilities
DNS-32344 vulnerabilities
DNS-32644 vulnerabilities
DNS-34344 vulnerabilities
DNS-726-444 vulnerabilities
DAP-132537 vulnerabilities
DIR-619L37 vulnerabilities
DIR-823X32 vulnerabilities

D-Link vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2022-37129HIGH	D-Link dir-816_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command parameter, it will be spliced into byte_4836B0 by snprintf, and finally doSystem(&byte_4836B0); will be executed, resulting in a command injection. CWE-77 CWE-78Aug 31, 2022	CVSS8.8v3.1	EPSS8.45%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-39509CRITICAL	D-Link dir-816_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection') An issue was discovered in D-Link DIR-816 DIR-816A2_FWv1.10CNB05_R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters. CWE-77Aug 24, 2021	CVSS9.8v3.1	EPSS5.1%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX