Dir 882
Monthly
OS command injection in D-Link DIR-882 router (firmware 1.01B02) allows authenticated remote attackers to execute arbitrary system commands via malicious IPAddress parameter to prog.cgi HNAP1 SetNetworkSettings handler. Requires high privileges (PR:H) but achieves full system compromise (CVSS 7.3). Publicly available exploit code exists. Product discontinued; vendor no longer provides security updates.
Unauthenticated information disclosure in D-Link DIR-882 routers (firmware up to 20260814) allows remote attackers to retrieve sensitive data by sending crafted requests to the /HNAP1/dllog.cgi CGI binary endpoint. The vulnerability resides in the main() function of the dllog.cgi component, which fails to properly restrict output before returning it to the caller. A public proof-of-concept exists, per the GitHub reference, which also links this endpoint to quick VPN settings disclosure - suggesting credentials or configuration material may be exposed. No public KEV listing and no vendor patch have been identified at time of analysis.
OS command injection in D-Link DIR-882 router (firmware 1.01B02) allows authenticated remote attackers to execute arbitrary system commands via malicious IPAddress parameter to prog.cgi HNAP1 SetNetworkSettings handler. Requires high privileges (PR:H) but achieves full system compromise (CVSS 7.3). Publicly available exploit code exists. Product discontinued; vendor no longer provides security updates.
Unauthenticated information disclosure in D-Link DIR-882 routers (firmware up to 20260814) allows remote attackers to retrieve sensitive data by sending crafted requests to the /HNAP1/dllog.cgi CGI binary endpoint. The vulnerability resides in the main() function of the dllog.cgi component, which fails to properly restrict output before returning it to the caller. A public proof-of-concept exists, per the GitHub reference, which also links this endpoint to quick VPN settings disclosure - suggesting credentials or configuration material may be exposed. No public KEV listing and no vendor patch have been identified at time of analysis.