D-Link Dap-1650 Firmware vulnerabilities

6 CVEs affecting D-Link Dap-1650 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-40505, published 2024-07-16.

More from D-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-23624, published 2024-01-26. Critical severity, CVSS 9.8. EPSS: 26% chance of exploitation in the next 30 days. A command injection vulnerability exists in the gena.cgi module of D-Link DAP-1650 devices. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
• CVE-2024-23625, published 2024-01-26. Critical severity, CVSS 9.8. EPSS: 7.3% chance of exploitation in the next 30 days. A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the…
• CVE-2019-12768, published 2020-12-30. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass authentication via forceful browsing.
• CVE-2019-12767, published 2020-03-21. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. An issue was discovered on D-Link DAP-1650 devices before 1.04B02_J65H Hot Fix. Attackers can execute arbitrary commands.
• CVE-2022-36588, published 2022-09-08. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. In D-Link DAP1650 v1.04 firmware, the fileaccess.cgi program in the firmware has a buffer overflow vulnerability caused by strncpy.
• CVE-2024-40505, published 2024-07-16. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 allows a local attacker to escalate privileges via the hedwig.cgi component.