CVE-2019-13372: D-Link Central Wifimanager

Critical severity, CVSS 9.8. EPSS: 82.5% chance of exploitation in the next 30 days.

/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication.

Affected products

• D-Link Central Wifimanager: up to and including 1.03

Published 2019-07-06. Last modified 2026-06-17.