D-Link Dnr-326 Firmware vulnerabilities

3 known vulnerabilities affecting d-link/dnr-326_firmware.

Total CVEs

3

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL3

Vulnerabilities

Page 1 of 1

CVE-2014-7859CRITICALCVSS 9.8≤ 1.40b032017-08-25

CVE-2014-7859 [CRITICAL] CWE-119 CVE-2014-7859: Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b0 Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-326 before 2.10 build 03, and DNS-327L before 1.04b01 allows remote attackers to execute arbitrary code by crafting malformed "Host" and "Referer" header values.

CVE-2014-7857CRITICALCVSS 9.8≤ 1.40b032017-08-25

CVE-2014-7857 [CRITICAL] CWE-287 CVE-2014-7857: D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320 D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter, and setting the spawned session's cook

CVE-2014-7858CRITICALCVSS 9.8≤ 1.40b032017-08-25

CVE-2014-7858 [CRITICAL] CWE-287 CVE-2014-7858: The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass au The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie parameter to an arbitrary string.