D-Link Dir-846 Firmware vulnerabilities

13 CVEs affecting D-Link Dir-846 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6580, published 2023-12-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-46314, published 2022-02-17. Critical severity, CVSS 9.8. EPSS: 33.3% chance of exploitation in the next 30 days. A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because…
CVE-2023-33735, published 2023-05-31. Critical severity, CVSS 9.8. EPSS: 31.6% chance of exploitation in the next 30 days. D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1 interface.
CVE-2020-27600, published 2021-04-02. Critical severity, CVSS 9.8. EPSS: 13.9% chance of exploitation in the next 30 days. HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1…
CVE-2022-46552, published 2023-02-02. High severity, CVSS 8.8. EPSS: 10.5% chance of exploitation in the next 30 days. D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted…
CVE-2021-46319, published 2022-02-17. Critical severity, CVSS 9.8. EPSS: 6.6% chance of exploitation in the next 30 days. Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use "\ " or backticks…
CVE-2021-46315, published 2022-02-17. Critical severity, CVSS 9.8. EPSS: 6.6% chance of exploitation in the next 30 days. Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use…
CVE-2019-17510, published 2019-10-11. Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days. D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell…
CVE-2019-17509, published 2019-10-11. Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days. D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with…
CVE-2022-46642, published 2022-12-23. Critical severity, CVSS 9.9. EPSS: 3.1% chance of exploitation in the next 30 days. D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.
CVE-2022-46641, published 2022-12-23. Critical severity, CVSS 9.9. EPSS: 3.1% chance of exploitation in the next 30 days. D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIpMacBindSettings function.

Latest

CVE-2023-6580, published 2023-12-07. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component QoS POST Handler. The manipulation of the…
CVE-2023-43284, published 2023-10-05. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecified manipulation of the QoS POST…
CVE-2020-21016, published 2022-10-31. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php.