Dir 846 Firmware

dir-846_firmware

Vendor: Dlink • 13 CVEs

CVEs (13)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-6580 1Dlink 1Dir 846 Firmware Jun 17, 2026 Dec 7, 2023 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component QoS POST Handler. The manipulation of the argument smartqos_ex...Show more A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component QoS POST Handler. The manipulation of the argument smartqos_express_devices/smartqos_normal_devices leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247161 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-43284 1Dlink 1Dir 846 Firmware Jun 17, 2026 Oct 5, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecified manipulation of the QoS POST parameter.
CVE-2023-33735 1Dlink 1Dir 846 Firmware Jun 17, 2026 May 31, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1 interface.
CVE-2022-46552 1Dlink 1Dir 846 Firmware Jun 17, 2026 Feb 2, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted POST request.
CVE-2022-46642 1Dlink 1Dir 846 Firmware Jun 17, 2026 Dec 23, 2022 N/A· v4 9.9 CRITICAL· v3 N/A· v2 D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.
CVE-2022-46641 1Dlink 1Dir 846 Firmware Jun 17, 2026 Dec 23, 2022 N/A· v4 9.9 CRITICAL· v3 N/A· v2 D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIpMacBindSettings function.
CVE-2020-21016 1Dlink 1Dir 846 Firmware Jun 17, 2026 Oct 31, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php.
CVE-2021-46319 1Dlink 1Dir 846 Firmware Jun 17, 2026 Feb 17, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use "\ " or backticks to bypass the shell...Show more Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use "\ " or backticks to bypass the shell metacharacters in the ssid0 or ssid1 parameters to execute arbitrary commands.This vulnerability is due to the fact that CVE-2019-17509 is not fully patched and can be bypassed by using line breaks or backticks on its basis.Show less
CVE-2021-46315 1Dlink 1Dir 846 Firmware Jun 17, 2026 Feb 17, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to us...Show more Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parameters to cause arbitrary command execution. Since CVE-2019-17510 vulnerability has not been patched and improved www/hnap1/control/setwizardconfig.php, can also use line breaks and backquotes to bypass.Show less
CVE-2021-46314 1Dlink 1Dir 846 Firmware Jun 17, 2026 Feb 17, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for...Show more A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for command injection when judging whether it is a reasonable domain name.Show less
CVE-2020-27600 1Dlink 1Dir 846 Firmware Jun 17, 2026 Apr 2, 2021 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter.
CVE-2019-17510 1Dlink 1Dir 846 Firmware Jun 17, 2026 Oct 11, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squas...Show more D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php.Show less
CVE-2019-17509 1Dlink 1Dir 846 Firmware Jun 17, 2026 Oct 11, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to...Show more D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php.Show less