D-Link Dns-320L Firmware vulnerabilities

2 known vulnerabilities affecting d-link/dns-320l_firmware.

Total CVEs

2

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL1MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2014-7857CRITICALCVSS 9.8≤ 1.03b042017-08-25

CVE-2014-7857 [CRITICAL] CWE-287 CVE-2014-7857: D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320 D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter, and setting the spawned session's cook

CVE-2014-7860MEDIUMCVSS 5.3≤ 1.03b042017-08-25

CVE-2014-7860 [MEDIUM] CWE-200 CVE-2014-7860: The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album_id and access_token.