d-link DIR-825 Security Vulnerabilities

6 Vulnerabilities

Description
UNSUPPORTED WHEN ASSIGNED Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vulnerability could be triggered by sending an HTTP request with URL /vct_wan; the sbin/httpd would invoke the strchr function and take NULL as a first argument, which finally leads to the segmentation fault. NOTE: The DIR-825 and all hardware revisions is considered End of Life and as such this issue will not be patched. Impacted versions: - Base Score: 0.0, Severity: NA, ID: CVE-2021-29296, Last Modified: 2021-08-10T20:15:00Z References Advisory
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution. Impacted versions: - Base Score: 0.0, Severity: NA, ID: CVE-2020-29557, Last Modified: 2021-01-29T20:15:00Z References Advisory
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected. Impacted versions: - Base Score: 0.0, Severity: NA, ID: CVE-2020-10213, Last Modified: 2020-03-07T01:40:00Z References Advisory
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntp_sync.cgi with a sufficiently long parameter ntp_server. Impacted versions: - Base Score: 0.0, Severity: NA, ID: CVE-2020-10214, Last Modified: 2020-03-07T01:40:00Z References Advisory
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected. Impacted versions: - Base Score: 0.0, Severity: NA, ID: CVE-2020-10215, Last Modified: 2020-03-07T01:40:00Z References Advisory
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected. Impacted versions: - Base Score: 0.0, Severity: NA, ID: CVE-2020-10216, Last Modified: 2020-03-07T01:40:00Z References Advisory

Description

** UNSUPPORTED WHEN ASSIGNED **Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vulnerability could be triggered by sending an HTTP request with URL /vct_wan; the sbin/httpd would invoke the strchr function and take NULL as a first argument, which finally leads to the segmentation fault. NOTE: The DIR-825 and all hardware revisions is considered End of Life and as such this issue will not be patched.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2021-29296, Last Modified: 2021-08-10T20:15:00Z

References

Advisory

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-29557, Last Modified: 2021-01-29T20:15:00Z

References

Advisory

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-10213, Last Modified: 2020-03-07T01:40:00Z

References

Advisory

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntp_sync.cgi with a sufficiently long parameter ntp_server.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-10214, Last Modified: 2020-03-07T01:40:00Z

References

Advisory

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-10215, Last Modified: 2020-03-07T01:40:00Z

References

Advisory

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.

Impacted versions: -

Base Score: 0.0, Severity: NA, ID: CVE-2020-10216, Last Modified: 2020-03-07T01:40:00Z

References

Advisory

USAGE: Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.