Product:

Dcs\-1130_firmware

(Dlink)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 18
Date Id Summary Products Score Patch Annotated
2019-07-02 CVE-2017-8408 An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a... Dcs\-1130_firmware 9.8
2020-01-28 CVE-2013-1599 A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface. Dcs\-1100_firmware, Dcs\-1100l_firmware, Dcs\-1130_firmware, Dcs\-1130l_firmware, Dcs\-2102_firmware, Dcs\-2121_firmware, Dcs\-3410_firmware, Dcs\-3411_firmware, Dcs\-3430_firmware, Dcs\-5230_firmware, Dcs\-5230l_firmware, Dcs\-5605_firmware, Dcs\-5635_firmware, Dcs\-6410_firmware, Dcs\-7410_firmware, Dcs\-7510_firmware, Wcs\-1100_firmware 9.8
2020-01-28 CVE-2013-1602 An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams. Dcs\-1100_firmware, Dcs\-1100l_firmware, Dcs\-1130_firmware, Dcs\-1130l_firmware, Dcs\-2102_firmware, Dcs\-2121_firmware, Dcs\-3410_firmware, Dcs\-3411_firmware, Dcs\-3430_firmware, Dcs\-5230_firmware, Dcs\-5230l_firmware, Dcs\-5605_firmware, Dcs\-5635_firmware, Dcs\-6410_firmware, Dcs\-7410_firmware, Dcs\-7510_firmware, Wcs\-1100_firmware 7.5
2019-07-02 CVE-2017-8417 An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any... Dcs\-1100_firmware, Dcs\-1130_firmware 8.8
2020-01-28 CVE-2013-1601 An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02,... Dcs\-1100_firmware, Dcs\-1100l_firmware, Dcs\-1130_firmware, Dcs\-1130l_firmware, Dcs\-2102_firmware, Dcs\-2121_firmware, Dcs\-3410_firmware, Dcs\-3411_firmware, Dcs\-3430_firmware, Dcs\-5230_firmware, Dcs\-5230l_firmware, Dcs\-5605_firmware, Dcs\-5635_firmware, Dcs\-6410_firmware, Dcs\-7410_firmware, Dcs\-7510_firmware, Wcs\-1100_firmware 5.3
2019-07-02 CVE-2017-8406 An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In this case, user's credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism... Dcs\-1130_firmware 8.8
2019-07-02 CVE-2017-8410 An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then... Dcs\-1100_firmware, Dcs\-1130_firmware 9.8
2019-07-02 CVE-2017-8412 An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable... Dcs\-1100_firmware, Dcs\-1130_firmware 8.8
2019-07-02 CVE-2017-8415 An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that... Dcs\-1100_firmware, Dcs\-1130_firmware 9.8
2019-07-02 CVE-2017-8404 An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a... Dcs\-1130_firmware 9.8