D-Link DIR-825 Rev.b Firmware vulnerabilities

3 CVEs affecting D-Link DIR-825 Rev.b Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-9126, published 2019-02-25.

More from D-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-9122, published 2019-02-25. High severity, CVSS 8.8. EPSS: 23.5% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntp_server parameter in an ntp_sync.cgi POST request.
• CVE-2019-9126, published 2019-02-25. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the router_info.xml document. This will reveal the PIN code, MAC…
• CVE-2019-9123, published 2019-02-25. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password.