Product:

Dir\-859_firmware

(Dlink)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 8
Date Id Summary Products Score Patch Annotated
2023-07-31 CVE-2023-36092 Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Dir\-859_firmware 9.8
2024-01-21 CVE-2024-0769 ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the... Dir\-859_firmware 9.8
2019-12-30 CVE-2019-17621 The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network. Dir\-818lx_firmware, Dir\-822_firmware, Dir\-823_firmware, Dir\-859_firmware, Dir\-865l_firmware, Dir\-868l_firmware, Dir\-869_firmware, Dir\-880l_firmware, Dir\-885l_firmware, Dir\-885r_firmware, Dir\-890l_firmware, Dir\-890r_firmware, Dir\-895l_firmware, Dir\-895r_firmware 9.8
2020-01-02 CVE-2019-20213 D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php. Dir\-818lx_firmware, Dir\-822_firmware, Dir\-823_firmware, Dir\-859_firmware, Dir\-865l_firmware, Dir\-868l_firmware, Dir\-869_firmware, Dir\-880l_firmware, Dir\-885l_firmware, Dir\-885r_firmware, Dir\-890l_firmware, Dir\-890r_firmware, Dir\-895l_firmware, Dir\-895r_firmware 7.5
2020-01-29 CVE-2019-20215 D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters. Dir\-859_firmware 9.8
2020-01-29 CVE-2019-20216 D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters. Dir\-859_firmware 9.8
2020-01-29 CVE-2019-20217 D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters. Dir\-859_firmware 9.8
2022-03-04 CVE-2022-25106 D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload. Dir\-859_a3_firmware, Dir\-859_firmware 5.5