D-Link DIR-823G vulnerabilities

A command injection vulnerability was discovered in the HNAP1 protocol on D-Link DIR-823G devices running firmware V1.0.2B05. An attacker can remotely execute arbitrary system commands by sending a crafted login request with shell metacharacters in the PrivateLogin field.

A vulnerability in the /cgi-bin/upload_firmware.cgi component of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors.

A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker can remotely execute arbitrary web scripts by sending shell metacharacters in the Captcha field during login.

A weakness has been identified in the web interface of D-link DIR-823G router version 1.0.2B05_20181207 in the file /etc/boa/boa.conf. Manipulation of this file can lead to a least privilege violation. The attack can be launched remotely but requires a high level of complexity.

A flaw in D-Link DIR-823G 1.0.2B05 in the vsftpd component allows remote violation of the least privilege principle.

A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries. The vulnerability occurs because parsed fields from the /tmp/new_qos.rule configuration file are concatenated into command strings and executed via system() without any sanitization.

A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit file. The vulnerability occurs because content read from this file is only partially validated for a prefix and then formatted using vsnprintf() before being executed with system(), allowing an attacker with write access to /var/system/linux_vlan_reinit to execute arbitrary commands on the device.