D-Link Dsr-500n Firmware vulnerabilities

8 CVEs affecting D-Link Dsr-500n Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-39615, published 2021-08-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-5945, published 2020-02-11. Critical severity, CVSS 9.8. EPSS: 9.8% chance of exploitation in the next 30 days. Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N,…
CVE-2013-5946, published 2013-12-19. High severity, CVSS 10.0. EPSS: 6.5% chance of exploitation in the next 30 days. The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500,…
CVE-2020-25759, published 2020-12-15. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacker to execute arbitrary commands, due to…
CVE-2021-39615, published 2021-08-23. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the cleartext password of the identified…
CVE-2020-25757, published 2020-12-15. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with…
CVE-2013-7004, published 2013-12-19. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware…
CVE-2020-25758, published 2020-12-15. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to inject arbitrary crontab entries into…
CVE-2013-7005, published 2013-12-19. Medium severity, CVSS 4.9. EPSS: 0.7% chance of exploitation in the next 30 days. D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware…