Hacker128

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-825M version 1.1.8 **Description** A command injection issue exists in the System Command Execution component. A remote attacker can manipulate the `sysCmd` argument within the `sub 456CF4()` function of the `/boafrm/formSysCmd` endpoint to execute arbitrary commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/boafrm/formSysCmd` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-825M version 1.1.8 **Description** A stack-based buffer overflow occurs in the Disk Formatting Handler Endpoint when processing the `/boafrm/formDiskFormat` endpoint. The issue is triggered by the manipulation of the `partition` argument within the `sub 46725C()` function, allowing for remote execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-825M version 1.1.8 **Description** A stack-based buffer overflow occurs in the LTE Module Firmware Upgrade component. The issue resides in the `sub 41802C()` function within the `/boafrm/formLtefotaUpgradeFibocom` file. A remote attacker can trigger this flaw by manipulating the `fota url` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/boafrm/formLtefotaUpgradeFibocom` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda AC18 version 15.03.05.05 **Description** A stack-based buffer overflow exists in the Web Management Interface. The issue occurs within the `sub 45304()` function of the '/goform/getRebootStatus' endpoint when the `callback` argument is manipulated. This allows a remote attacker to trigger the overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/goform/getRebootStatus' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda W20E version 15.11.0.6 **Description** A stack-based buffer overflow occurs when manipulating the `portMirrorMirroredPorts` argument within the `formSetPortMirror()` function of the `/goform/setPortMirror` endpoint. This issue allows for remote attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `/goform/setPortMirror` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda F451 versions 1.0.0.7 through 1.0.0.9 **Description** A stack-based buffer overflow exists in the Web Management Interface. This issue occurs within the `fromNatlimit()` function located in the `/goform/Natlimit` file. A remote attacker can trigger this by manipulating the `page` argument. A stack-based buffer overflow is a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially leading to crashes or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/goform/Natlimit` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda F451 versions 1.0.0.7 through 1.0.0.9 **Description** A security flaw in the Web Management Interface allows remote exploitation via OS command injection. The issue exists within the `formWriteFacMac()` function located in the `/goform/WriteFacMac` file. An attacker can trigger this by manipulating the `mac` argument. **Recommendations** For versions 1.0.0.7 through 1.0.0.9, disable remote management. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda W20E version 15.11.0.6 **Description** A flaw in the Web Management Interface allows a remote attack via a stack-based buffer overflow. This occurs when the `gotoUrl` argument is manipulated within the `formPortalAuth()` function of the `/goform/PortalAuth` endpoint. A stack-based buffer overflow is a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `/goform/PortalAuth` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda W20E version 15.11.0.6 **Description** A stack-based buffer overflow exists in the Web Management Interface component. This issue occurs when the `wifiFilterListRemark` argument is manipulated within the `modifyWifiFilterRules()` function of the '/goform/modifyWifiFilterRules' endpoint. A remote attacker can trigger this flaw to cause a memory corruption. A stack-based buffer overflow is a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially leading to crashes or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/goform/modifyWifiFilterRules' endpoint to minimize the risk of exploitation.