D-Link Central Wifimanager vulnerabilities

11 CVEs affecting D-Link Central Wifimanager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-13375, published 2019-07-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-13372, published 2019-07-06. Critical severity, CVSS 9.8. EPSS: 82.5% chance of exploitation in the next 30 days. /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username…
CVE-2019-13373, published 2019-07-06. Critical severity, CVSS 9.8. EPSS: 68% chance of exploitation in the next 30 days. An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the…
CVE-2018-15517, published 2019-01-31. High severity, CVSS 8.6. EPSS: 44.1% chance of exploitation in the next 30 days. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address,…
CVE-2018-17440, published 2018-10-08. Critical severity, CVSS 9.8. EPSS: 38.5% chance of exploitation in the next 30 days. An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). Taking…
CVE-2019-13375, published 2019-07-06. Critical severity, CVSS 9.8. EPSS: 28.2% chance of exploitation in the next 30 days. A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth parameter passcode. The vulnerability does…
CVE-2018-17442, published 2018-10-08. High severity, CVSS 8.8. EPSS: 14.2% chance of exploitation in the next 30 days. An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allows remote authenticated users to execute…
CVE-2018-17443, published 2018-10-08. Medium severity, CVSS 6.1. EPSS: 5.7% chance of exploitation in the next 30 days. An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XSS.
CVE-2018-17441, published 2018-10-08. Medium severity, CVSS 6.1. EPSS: 5.7% chance of exploitation in the next 30 days. An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS.
CVE-2018-15515, published 2019-01-31. High severity, CVSS 7.8. EPSS: 2.5% chance of exploitation in the next 30 days. The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the CaptivelPortal.exe subdirectory under the D-Link directory, which…
CVE-2019-13374, published 2019-07-06. Medium severity, CVSS 6.1. EPSS: 2.4% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to inject arbitrary web…

Latest

CVE-2018-15516, published 2019-01-31. Medium severity, CVSS 5.8. EPSS: 2% chance of exploitation in the next 30 days. The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in SSRF.