pwn.watch: Router incident updates

[critical] D-Link DIR-820 Router OS Command Injection

Mon, 30 Sep 2024 00:00:00 GMT

D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. Added to the CISA KEV catalog on 2024-09-30. CVE-2023-25280 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: unpatched · Fixed in: No fix: CISA says the product is end-of-life and should be retired

Latest updates:

2024-09-30: CISA added CVE-2023-25280 to the KEV catalog (federal deadline 2024-10-21) (source)

CVEs: CVE-2023-25280

[critical] DrayTek Multiple Vigor Routers OS Command Injection

Mon, 30 Sep 2024 00:00:00 GMT

DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used. Added to the CISA KEV catalog on 2024-09-30. CVE-2020-15415 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-09-30: CISA added CVE-2020-15415 to the KEV catalog (federal deadline 2024-10-21) (source)

CVEs: CVE-2020-15415

[high] DrayTek VigorConnect: 2 actively exploited vulnerabilities

Tue, 03 Sep 2024 00:00:00 GMT

CVE-2021-20123: Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. CVE-2021-20124: Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Added to the CISA KEV catalog on 2024-09-03. CVE-2021-20123, CVE-2021-20124 were assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-09-03: CISA added CVE-2021-20123 to the KEV catalog (federal deadline 2024-09-24) (source)
2024-09-03: CISA added CVE-2021-20124 to the KEV catalog (federal deadline 2024-09-24) (source)

CVEs: CVE-2021-20123, CVE-2021-20124

[high] D-Link DIR-600 Router Cross-Site Request Forgery (CSRF)

Thu, 16 May 2024 00:00:00 GMT

D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session. Added to the CISA KEV catalog on 2024-05-16. CVE-2014-100005 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: unpatched · Fixed in: No fix: CISA says the product is end-of-life and should be retired

Latest updates:

2024-05-16: CISA added CVE-2014-100005 to the KEV catalog (federal deadline 2024-06-06) (source)

CVEs: CVE-2014-100005

[high] D-Link DIR-605 Router Information Disclosure

Thu, 16 May 2024 00:00:00 GMT

D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. Added to the CISA KEV catalog on 2024-05-16. CVE-2021-40655 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: unpatched · Fixed in: No fix: CISA says the product is end-of-life and should be retired

Latest updates:

2024-05-16: CISA added CVE-2021-40655 to the KEV catalog (federal deadline 2024-06-06) (source)

CVEs: CVE-2021-40655