CVE Vulnerability Advisory Database

[Affected Scope] D-Link DIR-823X router firmware versions 240126 and 240802.

[Impact] An authorized attacker can execute arbitrary system commands with root privileges and fully compromise the device by sending a crafted HTTP POST request to the /goform/set_prohibiting endpoint.

[Mitigation] Apply the official firmware patch immediately, disable remote WAN management, and enforce strong administrator credentials.

[Affected Scope] FXC AE1021PE firmware version 2.0.9 and earlier, and AE1021 firmware version 2.0.9 and earlier

[Impact] An authenticated attacker can execute arbitrary OS commands with root privileges, potentially leading to full device takeover and botnet recruitment

[Mitigation] Immediately apply the official firmware patch (v2.0.10 or later) and restrict access to the management interface

[Affected Scope] TP-Link TL-WR940N (V2/V4), TL-WR841N (V8/V10), and TL-WR740N (V1/V2) routers

[Impact] Authenticated attackers can execute arbitrary system commands and gain full control of the device via a vulnerable web component

[Mitigation] Apply the latest firmware updates immediately, disable remote WAN management, and change default administrator credentials

[Affected Scope] D-Link DIR-820L router with firmware version DIR820LA1_FW105B03 and prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via a crafted HTTP request

[Mitigation] Since this product is End-of-Life (EOL), immediate hardware replacement is highly recommended; otherwise, disable remote management and restrict access

[Affected Scope] D-Link DIR-820L firmware version 1.05B03 and prior.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via crafted HTTP POST requests, leading to full device compromise.

[Mitigation] Since this device is End-of-Life (EOL), immediate replacement of the hardware is highly recommended. Alternatively, disable remote management and restrict access.

[Affected Scope] D-Link DIR-605 B2 Firmware Version 2.01MT and prior

[Impact] Unauthenticated remote attackers can retrieve plaintext administrator credentials by sending a forged POST request to the /getcfg.php page

[Mitigation] Immediately decommission and replace the legacy EOL device, or disable remote WAN management and restrict network access

[Affected Scope] DrayTek Vigor3900, Vigor2960, and Vigor300B devices running firmware versions prior to 1.5.1

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending a specially crafted HTTP POST request

[Mitigation] Immediately upgrade the device firmware to version 1.5.1 or higher and disable external WAN access to the management interface

[Affected Scope] Web-based management interface of certain Cisco Small Business RV Series Routers (including RV110W, RV130, RV130W, RV215W).

[Impact] An authenticated, remote attacker with valid credentials or an active session token can execute arbitrary commands with root privileges.

[Mitigation] Apply the official firmware updates from the vendor, or disable remote WAN management and restrict access to the web interface.

[Affected Scope] D-Link router and AP models including DIR-655C, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and achieve full system compromise by sending specially crafted HTTP requests.

[Mitigation] Since most affected devices are End-of-Life (EoL), immediately replace them with supported models, or restrict WAN-side management access and disable remote administration.

[Affected Scope] ZyXEL P660HN-T1A v1 routers distributed by TrueOnline running TCLinux Firmware v7.3.15.0 v001 / 3.40(ULM.0)b31 or prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by manipulating the remote_host parameter in the ViewLog.asp page

[Mitigation] Immediately disable external WAN access to the web management interface, apply the latest firmware updates, or replace legacy end-of-life devices

[Affected Scope] Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers running vulnerable firmware versions.

[Impact] Unauthenticated remote attackers can download sensitive router configuration files and diagnostic data, potentially exposing administrative credentials and network layouts.

[Mitigation] Apply the official firmware updates provided by Cisco immediately and disable remote WAN management access.

[Affected Scope] Dasan GPON home routers

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and gain full control of the device by sending specially crafted HTTP requests

[Mitigation] Apply the latest firmware updates from the vendor, disable external WAN-side management access, and restrict access to trusted networks

[Affected Scope] D-Link router models DIR-880L (v1.08B04 and prior), DIR-868L (v1.12b04 and prior), DIR-865L (v1.08.B01 and prior), and DIR-860L (v1.10b04 and prior)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the target router by manipulating specific parameters in SOAP API requests, leading to complete device compromise

[Mitigation] Apply the latest official firmware patches provided by the vendor, disable remote WAN management interfaces, or replace end-of-life devices

[Affected Scope] NETGEAR DGN2200 wireless ADSL2+ modem router devices running firmware versions up to and including 10.0.0.50.

[Impact] Remote authenticated attackers can execute arbitrary OS commands with root privileges via shell metacharacters in the ping_IPAddr parameter of HTTP POST requests, leading to complete device compromise.

[Mitigation] Apply the latest official firmware updates from NETGEAR, disable remote management, and restrict access to the web administration interface.

[Affected Scope] Multiple NETGEAR router models including R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220, D6400, and D7000

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by injecting shell metacharacters into the cgi-bin path info

[Mitigation] Apply the latest official firmware patches provided by the vendor, or temporarily disable the web server as a workaround

[Affected Scope] TP-LINK router models including Archer C5/C7/C8/C9, TL-WDR3500/3600/4300, TL-WR740N/741ND/841N/841ND running vulnerable firmware versions

[Impact] Unauthenticated remote attackers can read arbitrary system files and sensitive configuration data by injecting directory traversal sequences (..) into the PATH_INFO parameter

[Mitigation] Immediately upgrade to the patched firmware versions provided by TP-LINK and disable WAN-side remote management interfaces

[Affected Scope] D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via a crafted GetDeviceSettings action to the HNAP interface

[Mitigation] Disable remote management, block external access to the HNAP interface, and immediately replace the End-of-Life (EoL) device with a supported model