Ziyue Xie

**Name of the Vulnerable Software and Affected Versions** Wavlink NU516U1 version 240425 **Description** A weakness in the `wzdapMesh()` function within the '/cgi-bin/adm.cgi' endpoint allows for remote OS command injection. This occurs when the system fails to properly sanitize input, enabling an attacker to execute arbitrary operating system commands on the device. **Recommendations** As a temporary workaround, restrict access to the '/cgi-bin/adm.cgi' endpoint or disable the `wzdapMesh()` function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wavlink NU516U1 version 240425 **Description** A flaw in the `sys login1()` function within the '/cgi-bin/login.cgi' endpoint allows for remote OS command injection. This occurs through the manipulation of the `ipaddr` argument, which could lead to full system compromise. This issue is under active exploitation. **Recommendations** Update Wavlink NU516U1 version 240425 to the latest patched version. As a temporary workaround, restrict access to the '/cgi-bin/login.cgi' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Wavlink NU516U1 version 240425 **Description** An OS command injection flaw exists in the `WifiBasic()` function within the '/cgi-bin/wireless.cgi' endpoint. This issue occurs when the `AuthMethod` or `EncrypType` arguments are manipulated, allowing for remote exploitation. **Recommendations** As a temporary workaround, restrict access to the '/cgi-bin/wireless.cgi' endpoint or avoid using the `AuthMethod` and `EncrypType` parameters until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wavlink NU516U1 version 240425 **Description** A remote OS command injection exists in the `advance()` function of the '/cgi-bin/wireless.cgi' endpoint. This occurs through the manipulation of the `wlan conf/Channel/skiplist/ieee 80211h` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wavlink NU516U1 M16U1 V240425 **Description** An OS command injection flaw exists in the `wzdrepeater()` function within the '/cgi-bin/adm.cgi' endpoint. This issue allows a remote attacker to execute arbitrary operating system commands by manipulating the `wlan bssid`, `sel Automode`, or `sel EncrypTyp` arguments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/cgi-bin/adm.cgi' endpoint or avoid using the `wlan bssid`, `sel Automode`, and `sel EncrypTyp` parameters.

**Name of the Vulnerable Software and Affected Versions** Wavlink NU516U1 version M16U1 V240425 **Description** Remote OS command injection is possible via the `change wifi password` function within the '/cgi-bin/adm.cgi' endpoint. The issue occurs when manipulating the `wl channel`, `wl Pass`, or `EncrypType` arguments, allowing an attacker to execute arbitrary operating system commands remotely. **Recommendations** As a temporary workaround, restrict access to the '/cgi-bin/adm.cgi' endpoint or avoid using the `change wifi password` function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wavlink NU516U1 version M16U1 V240425 **Description** An OS command injection flaw exists in the `wan()` function within the '/cgi-bin/adm.cgi' endpoint. A remote attacker can exploit this by manipulating the `ppp username`, `ppp passwd`, `rwan ip`, `rwan mask`, and `rwan gateway` arguments, which are passed directly to the system without proper validation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wavlink NU516U1 version M16U1 V240425 **Description** Remote OS command injection is possible via the 'wifi region' function within the '/cgi-bin/adm.cgi' endpoint. This occurs through the manipulation of the `skiplist1` and `skiplist2` arguments, allowing an attacker to execute arbitrary operating system commands remotely. **Recommendations** As a temporary workaround, restrict access to the '/cgi-bin/adm.cgi' endpoint or avoid using the `skiplist1` and `skiplist2` arguments within the 'wifi region' function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wavlink NU516U1 M16U1 V240425 **Description** A remote OS command injection flaw exists in the `wzdap()` function within the '/cgi-bin/adm.cgi' endpoint. The issue occurs because the `EncrypType` and `wl Pass` arguments are passed directly to the system without proper validation, allowing an attacker to execute arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/cgi-bin/adm.cgi' endpoint or avoid using the `EncrypType` and `wl Pass` parameters until a patch is available.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-120 D-Link DNR-202L D-Link DNS-315L D-Link DNS-320 D-Link DNS-320L D-Link DNS-320LW D-Link DNS-321 D-Link DNR-322L D-Link DNS-323 D-Link DNS-325 D-Link DNS-326 D-Link DNS-327L D-Link DNR-326 D-Link DNS-340L D-Link DNS-343 D-Link DNS-345 D-Link DNS-726-4 D-Link DNS-1100-4 D-Link DNS-1200-05 D-Link DNS-1550-04 versions prior to 20260205 **Description** A stack-based buffer overflow exists due to the manipulation of the `Name` argument in the `cgi addgroup get group quota minsize` function located in the `/cgi-bin/account mgr.cgi` file. This allows for remote attacks. The exploit has been publicly released. **Recommendations** For D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 versions prior to 20260205, update to a newer version.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-120 D-Link DNR-202L D-Link DNS-315L D-Link DNS-320 D-Link DNS-320L D-Link DNS-320LW D-Link DNS-321 D-Link DNR-322L D-Link DNS-323 D-Link DNS-325 D-Link DNS-326 D-Link DNS-327L D-Link DNR-326 D-Link DNS-340L D-Link DNS-343 D-Link DNS-345 D-Link DNS-726-4 D-Link DNS-1100-4 D-Link DNS-1200-05 D-Link DNS-1550-04 versions prior to 20260205 **Description** A stack-based buffer overflow issue exists in the `Webdav Upload File` function located in the `/cgi-bin/webdav mgr.cgi` file. The issue is triggered by manipulating the `f file` argument. This allows for remote exploitation. The exploit has been publicly disclosed. **Recommendations** Update devices to the latest firmware version available.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-120 D-Link DNR-202L D-Link DNS-315L D-Link DNS-320 D-Link DNS-320L D-Link DNS-320LW D-Link DNS-321 D-Link DNR-322L D-Link DNS-323 D-Link DNS-325 D-Link DNS-326 D-Link DNS-327L D-Link DNR-326 D-Link DNS-340L D-Link DNS-343 D-Link DNS-345 D-Link DNS-726-4 D-Link DNS-1100-4 D-Link DNS-1200-05 D-Link DNS-1550-04 versions prior to 20260205 **Description** A flaw exists that can lead to a stack-based buffer overflow. The issue is located in the `UPnP AV Server Path Del` function within the `/cgi-bin/app mgr.cgi` file. Manipulation of the `f dir` argument can trigger the overflow. This can be exploited remotely. **Recommendations** For D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, update to a version after 20260205.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-120 versions prior to 20260205 D-Link DNR-202L versions prior to 20260205 D-Link DNS-315L versions prior to 20260205 D-Link DNS-320 versions prior to 20260205 D-Link DNS-320L versions prior to 20260205 D-Link DNS-320LW versions prior to 20260205 D-Link DNS-321 versions prior to 20260205 D-Link DNR-322L versions prior to 20260205 D-Link DNS-323 versions prior to 20260205 D-Link DNS-325 versions prior to 20260205 D-Link DNS-326 versions prior to 20260205 D-Link DNS-327L versions prior to 20260205 D-Link DNR-326 versions prior to 20260205 D-Link DNS-340L versions prior to 20260205 D-Link DNS-343 versions prior to 20260205 D-Link DNS-345 versions prior to 20260205 D-Link DNS-726-4 versions prior to 20260205 D-Link DNS-1100-4 versions prior to 20260205 D-Link DNS-1200-05 versions prior to 20260205 D-Link DNS-1550-04 versions prior to 20260205 **Description** Improper access controls exist in the `Webdav Access List()` function within the `/cgi-bin/file center.cgi` endpoint. A remote attacker can manipulate the `cmd` variable to bypass security restrictions and gain unauthorized access to protected information. **Recommendations** Update D-Link DNS-120 to version 20260205 or later. Update D-Link DNR-202L to version 20260205 or later. Update D-Link DNS-315L to version 20260205 or later. Update D-Link DNS-320 to version 20260205 or later. Update D-Link DNS-320L to version 20260205 or later. Update D-Link DNS-320LW to version 20260205 or later. Update D-Link DNS-321 to version 20260205 or later. Update D-Link DNR-322L to version 20260205 or later. Update D-Link DNS-323 to version 20260205 or later. Update D-Link DNS-325 to version 20260205 or later. Update D-Link DNS-326 to version 20260205 or later. Update D-Link DNS-327L to version 20260205 or later. Update D-Link DNR-326 to version 20260205 or later. Update D-Link DNS-340L to version 20260205 or later. Update D-Link DNS-343 to version 20260205 or later. Update D-Link DNS-345 to version 20260205 or later. Update D-Link DNS-726-4 to version 20260205 or later. Update D-Link DNS-1100-4 to version 20260205 or later. Update D-Link DNS-1200-05 to version 20260205 or later. Update D-Link DNS-1550-04 to version 20260205 or later. As a temporary workaround, restrict access to the `/cgi-bin/file center.cgi` endpoint.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-120 versions prior to 20260205 D-Link DNR-202L versions prior to 20260205 D-Link DNS-315L versions prior to 20260205 D-Link DNS-320 versions prior to 20260205 D-Link DNS-320L versions prior to 20260205 D-Link DNS-320LW versions prior to 20260205 D-Link DNS-321 versions prior to 20260205 D-Link DNR-322L versions prior to 20260205 D-Link DNS-323 versions prior to 20260205 D-Link DNS-325 versions prior to 20260205 D-Link DNS-326 versions prior to 20260205 D-Link DNS-327L versions prior to 20260205 D-Link DNR-326 versions prior to 20260205 D-Link DNS-340L versions prior to 20260205 D-Link DNS-343 versions prior to 20260205 D-Link DNS-345 versions prior to 20260205 D-Link DNS-726-4 versions prior to 20260205 D-Link DNS-1100-4 versions prior to 20260205 D-Link DNS-1200-05 versions prior to 20260205 D-Link DNS-1550-04 versions prior to 20260205 **Description** Improper access controls in the `/cgi-bin/dsk mgr.cgi` endpoint allow a remote attacker to perform unauthorized manipulations. This issue affects several functions within the specified file, including `FMT restart()`, `Status HDInfo()`, `SMART List()`, `ScanDisk info()`, `ScanDisk()`, `volume status()`, `Get Volume Mapping()`, `FMT check disk remount state()`, `FMT rebuildinfo()`, `FMT result list()`, `FMT result list phy()`, `FMT get dminfo()`, `FMT manually rebuild info()`, and `Get current raidtype()`. Successful exploitation can impact the availability of protected information. **Recommendations** Update D-Link DNS-120 to version 20260205 or later. Update D-Link DNR-202L to version 20260205 or later. Update D-Link DNS-315L to version 20260205 or later. Update D-Link DNS-320 to version 20260205 or later. Update D-Link DNS-320L to version 20260205 or later. Update D-Link DNS-320LW to version 20260205 or later. Update D-Link DNS-321 to version 20260205 or later. Update D-Link DNR-322L to version 20260205 or later. Update D-Link DNS-323 to version 20260205 or later. Update D-Link DNS-325 to version 20260205 or later. Update D-Link DNS-326 to version 20260205 or later. Update D-Link DNS-327L to version 20260205 or later. Update D-Link DNR-326 to version 20260205 or later. Update D-Link DNS-340L to version 20260205 or later. Update D-Link DNS-343 to version 20260205 or later. Update D-Link DNS-345 to version 20260205 or later. Update D-Link DNS-726-4 to version 20260205 or later. Update D-Link DNS-1100-4 to version 20260205 or later. Update D-Link DNS-1200-05 to version 20260205 or later. Update D-Link DNS-1550-04 to version 20260205 or later. As a temporary mitigation, restrict access to the `/cgi-bin/dsk mgr.cgi` endpoint.

Name of the Vulnerable Software and Affected Versions D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 versions up to 20260205. Description A flaw exists in the `cgi get ipv6` function within the `/cgi-bin/network mgr.cgi` file, leading to improper access controls. The exploit is publicly available. Recommendations Update the affected D-Link devices to a version later than 20260205.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-120 versions prior to 20260205 D-Link DNR-202L versions prior to 20260205 D-Link DNS-315L versions prior to 20260205 D-Link DNS-320 versions prior to 20260205 D-Link DNS-320L versions prior to 20260205 D-Link DNS-320LW versions prior to 20260205 D-Link DNS-321 versions prior to 20260205 D-Link DNR-322L versions prior to 20260205 D-Link DNS-323 versions prior to 20260205 D-Link DNS-325 versions prior to 20260205 D-Link DNS-326 versions prior to 20260205 D-Link DNS-327L versions prior to 20260205 D-Link DNR-326 versions prior to 20260205 D-Link DNS-340L versions prior to 20260205 D-Link DNS-343 versions prior to 20260205 D-Link DNS-345 versions prior to 20260205 D-Link DNS-726-4 versions prior to 20260205 D-Link DNS-1100-4 versions prior to 20260205 D-Link DNS-1200-05 versions prior to 20260205 D-Link DNS-1550-04 versions prior to 20260205 **Description** A flaw exists that allows for remote manipulation of the `read list` argument within the `cgi adduser to session` function located in the `/cgi-bin/account mgr.cgi` file. This manipulation can lead to a stack-based buffer overflow. The exploit for this issue has been publicly disclosed. **Recommendations** D-Link DNS-120 versions prior to 20260205 should be updated. D-Link DNR-202L versions prior to 20260205 should be updated. D-Link DNS-315L versions prior to 20260205 should be updated. D-Link DNS-320 versions prior to 20260205 should be updated. D-Link DNS-320L versions prior to 20260205 should be updated. D-Link DNS-320LW versions prior to 20260205 should be updated. D-Link DNS-321 versions prior to 20260205 should be updated. D-Link DNR-322L versions prior to 20260205 should be updated. D-Link DNS-323 versions prior to 20260205 should be updated. D-Link DNS-325 versions prior to 20260205 should be updated. D-Link DNS-326 versions prior to 20260205 should be updated. D-Link DNS-327L versions prior to 20260205 should be updated. D-Link DNR-326 versions prior to 20260205 should be updated. D-Link DNS-340L versions prior to 20260205 should be updated. D-Link DNS-343 versions prior to 20260205 should be updated. D-Link DNS-345 versions prior to 20260205 should be updated. D-Link DNS-726-4 versions prior to 20260205 should be updated. D-Link DNS-1100-4 versions prior to 20260205 should be updated. D-Link DNS-1200-05 versions prior to 20260205 should be updated. D-Link DNS-1550-04 versions prior to 20260205 should be updated.