Dir 816 Firmware

CVEs (75)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2022-43002	Dlink DIR-816	Cri	0.64	9.8	0.01	Oct 26, 2022	D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54.
CVE-2022-43001	Dlink DIR-816	Cri	0.64	9.8	0.01	Oct 26, 2022	D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function.
CVE-2022-43000	Dlink DIR-816	Cri	0.64	9.8	0.01	Oct 26, 2022	D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4.
CVE-2022-42998	Dlink DIR-816	Cri	0.64	9.8	0.01	Oct 26, 2022	D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.
CVE-2022-37125	Dlink DIR-816	Cri	0.64	9.8	0.03	Aug 31, 2022	D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.
CVE-2022-29327	Dlink DIR-816	Cri	0.64	9.8	0.04	May 10, 2022	D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the urladd parameter in /goform/websURLFilterAddDel.
CVE-2022-29326	Dlink DIR-816	Cri	0.64	9.8	0.04	May 10, 2022	D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the addhostfilter parameter in /goform/websHostFilter.
CVE-2022-29325	Dlink DIR-816	Cri	0.64	9.8	0.04	May 10, 2022	D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the addurlfilter parameter in /goform/websURLFilter.
CVE-2022-29324	Dlink DIR-816	Cri	0.64	9.8	0.04	May 10, 2022	D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the proto parameter in /goform/form2IPQoSTcAdd.
CVE-2022-29323	Dlink DIR-816	Cri	0.64	9.8	0.04	May 10, 2022	D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the MAC parameter in /goform/editassignment.
CVE-2022-29321	Dlink DIR-816	Cri	0.64	9.8	0.04	May 10, 2022	D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the lanip parameter in /goform/setNetworkLan.
CVE-2022-28915	Dlink DIR-816	Cri	0.64	9.8	0.07	May 10, 2022	D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a command injection vulnerability via the admuser and admpass parameters in /goform/setSysAdm.
CVE-2021-31326	Dlink DIR-816	Cri	0.64	9.8	0.02	Mar 24, 2022	D-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parameter to /goform/form2Reboot.cgi.
CVE-2021-39510	Dlink DIR816_A1_FW101CNB04	Cri	0.64	9.8	0.09	Aug 24, 2021	An issue was discovered in D-Link DIR816_A1_FW101CNB04 750m11ac wireless router, The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command…
CVE-2021-39509	Dlink DIR-816	Cri	0.64	9.8	0.05	Aug 24, 2021	An issue was discovered in D-Link DIR-816 DIR-816A2_FWv1.10CNB05_R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection…
CVE-2021-27113	Dlink Dir 816 Firmware	Cri	0.64	9.8	0.03	Apr 14, 2021	An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters.
CVE-2021-26810	Dlink Dir 816 Firmware	Cri	0.64	9.8	0.05	Mar 30, 2021	D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handler function of the /goform/dir_setWanWifi, which can lead to command injection via shell metacharacters in the…
CVE-2019-10041	Dlink Dir 816 Firmware	Cri	0.64	9.8	0.02	Mar 25, 2019	The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication.
CVE-2019-10040	Dlink Dir 816 Firmware	Cri	0.64	9.8	0.03	Mar 25, 2019	The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication.
CVE-2019-10039	Dlink Dir 816 Firmware	Cri	0.64	9.8	0.02	Mar 25, 2019	The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/setSysAdm to edit the web or system account without authentication.

CVE-2022-43002CriOct 26, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.01
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54.
CVE-2022-43001CriOct 26, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.01
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function.
CVE-2022-43000CriOct 26, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.01
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4.
CVE-2022-42998CriOct 26, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.01
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.
CVE-2022-37125CriAug 31, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.03
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.
CVE-2022-29327CriMay 10, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.04
D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the urladd parameter in /goform/websURLFilterAddDel.
CVE-2022-29326CriMay 10, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.04
D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the addhostfilter parameter in /goform/websHostFilter.
CVE-2022-29325CriMay 10, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.04
D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the addurlfilter parameter in /goform/websURLFilter.
CVE-2022-29324CriMay 10, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.04
D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the proto parameter in /goform/form2IPQoSTcAdd.
CVE-2022-29323CriMay 10, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.04
D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the MAC parameter in /goform/editassignment.
CVE-2022-29321CriMay 10, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.04
D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the lanip parameter in /goform/setNetworkLan.
CVE-2022-28915CriMay 10, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.07
D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a command injection vulnerability via the admuser and admpass parameters in /goform/setSysAdm.
CVE-2021-31326CriMar 24, 2022
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.02
D-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parameter to /goform/form2Reboot.cgi.
CVE-2021-39510CriAug 24, 2021
Dlink
DIR816_A1_FW101CNB04
risk 0.64cvss 9.8epss 0.09
An issue was discovered in D-Link DIR816_A1_FW101CNB04 750m11ac wireless router, The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command…
CVE-2021-39509CriAug 24, 2021
Dlink
DIR-816
risk 0.64cvss 9.8epss 0.05
An issue was discovered in D-Link DIR-816 DIR-816A2_FWv1.10CNB05_R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection…
CVE-2021-27113CriApr 14, 2021
Dlink
Dir 816 Firmware
risk 0.64cvss 9.8epss 0.03
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters.
CVE-2021-26810CriMar 30, 2021
Dlink
Dir 816 Firmware
risk 0.64cvss 9.8epss 0.05
D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handler function of the /goform/dir_setWanWifi, which can lead to command injection via shell metacharacters in the…
CVE-2019-10041CriMar 25, 2019
Dlink
Dir 816 Firmware
risk 0.64cvss 9.8epss 0.02
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication.
CVE-2019-10040CriMar 25, 2019
Dlink
Dir 816 Firmware
risk 0.64cvss 9.8epss 0.03
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication.
CVE-2019-10039CriMar 25, 2019
Dlink
Dir 816 Firmware
risk 0.64cvss 9.8epss 0.02
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/setSysAdm to edit the web or system account without authentication.

Page 2 of 4