Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
530 results · page 5 of 11
Apr 17, 2024Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability in the fromDhcpListClient function.CVE-2024-32316 · Network & remote access · tenda · reported by MITREMedium 6.5
Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability in the fromDhcpListClient function.
- Product
- ac500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromDhcpListClient function.CVE-2024-32293 · Network & remote access · tenda · reported by MITREHigh 8
Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromDhcpListClient function.
- Product
- w30e_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of service via the LISTEN parameter in the fromDhcpListClient functCVE-2024-30840 · Network & remote access · tenda · reported by MITREMedium 6.5
A Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of service via the LISTEN parameter in the fromDhcpListClient function.
- Product
- ac15_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024DHCP Server Service Denial of Service VulnerabilityCVE-2024-26215 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
DHCP Server Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024DHCP Server Service Denial of Service VulnerabilityCVE-2024-26212 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
DHCP Server Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024DHCP Server Service Remote Code Execution VulnerabilityCVE-2024-26202 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
DHCP Server Service Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024DHCP Server Service Remote Code Execution VulnerabilityCVE-2024-26195 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
DHCP Server Service Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 1, 2024TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-1179 · Network & remote access · TP-Link · reported by zdi-disclosures@trendmicro.comHigh 8.8
TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DHCP options. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22420.
- Product
- Omada ER605
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Mar 29, 2024Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the list1 parameter from fromDhcpListClient function.CVE-2024-30629 · Network & remote access · tenda · reported by MITREMedium 5.7
Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the list1 parameter from fromDhcpListClient function.
- Product
- fh1205_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromDhcpListClient function.CVE-2024-30623 · Network & remote access · tenda · reported by MITREMedium 6.5
Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromDhcpListClient function.
- Product
- fh1205_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function.CVE-2024-30604 · Network & remote access · tenda · reported by MITREHigh 7.5
Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function.
- Product
- fh1203_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the page parameter of the fromDhcpListClient function.CVE-2024-30606 · Network & remote access · tenda · reported by MITREHigh 8
Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the page parameter of the fromDhcpListClient function.
- Product
- fh1203_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexCVE-2024-20259 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a crafted IPv4 DHCP request packet being mishandled when endpoint analytics are enabled. An attacker could exploit this vulnerability by sending a crafted DHCP request through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: The attack vector is listed as network because a DHCP relay anywhere on the network could allow exploits from networks other than the adjacent one.
- Product
- Cisco IOS XE Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 13, 2024A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of theCVE-2024-20266 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process, resulting in a denial of service (DoS) condition. This vulnerability exists because certain DHCPv4 messages are improperly validated when they are processed by an affected device. An attacker could exploit this vulnerability by sending a malformed DHCPv4 message to an affected device. A successful exploit could allow the attacker to cause a crash of the dhcpd process. While the dhcpd process is restarting, which may take approximately two minutes, DHCPv4 server services are unavailable on the affected device. This could temporarily prevent network access to clients that join the network during that time period and rely on the DHCPv4 server of the affected device. Notes: Only the dhcpd process crashes and eventually restarts automatically. The router does not reload. This vulnerability only applies to DHCPv4. DHCP version 6 (DHCPv6) is not affected.
- Product
- Cisco IOS XR Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jan 30, 2024TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules functiCVE-2024-24326 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules function.
- Product
- a3300r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message.CVE-2023-45235 · Other software · TianoCore · reported by infosec@edk2.groups.ioHigh 8.3
EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
- Product
- edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jan 16, 2024EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message.CVE-2023-45234 · Other software · TianoCore · reported by infosec@edk2.groups.ioHigh 8.3
EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
- Product
- edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jan 16, 2024EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client.CVE-2023-45230 · Other software · TianoCore · reported by infosec@edk2.groups.ioHigh 8.3
EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
- Product
- edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jan 16, 2024EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message.CVE-2023-45229 · Other software · TianoCore · reported by infosec@edk2.groups.ioMedium 6.5
EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
- Product
- edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jan 11, 2024 An Improper Check for Unusual or Exceptional Conditions vulnerability in Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent, unauthenCVE-2023-36842 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.5
An Improper Check for Unusual or Exceptional Conditions vulnerability in Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause the jdhcpd to consume all the CPU cycles resulting in a Denial of Service (DoS). On Junos OS devices with forward-snooped-client configured, if an attacker sends a specific DHCP packet to a non-configured interface, this will cause an infinite loop. The DHCP process will have to be restarted to recover the service. This issue affects: Juniper Networks Junos OS * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R2.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.netfirst.org
Dec 12, 2023DHCP Server Service Information Disclosure VulnerabilityCVE-2023-36012 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
DHCP Server Service Information Disclosure Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 12, 2023DHCP Server Service Information Disclosure VulnerabilityCVE-2023-35643 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
DHCP Server Service Information Disclosure Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 12, 2023DHCP Server Service Denial of Service VulnerabilityCVE-2023-35638 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
DHCP Server Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 8, 2023In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check.CVE-2023-48423 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 14, 2023DHCP Server Service Denial of Service VulnerabilityCVE-2023-36392 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
DHCP Server Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023DHCP Server Service Denial of Service VulnerabilityCVE-2023-36703 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
DHCP Server Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 28, 2023D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanDhcpplus function.CVE-2023-43863 · Network & remote access · d-link · reported by MITREHigh 7.5
D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanDhcpplus function.
- Product
- dir-619l
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter nvmacaddr in form2Dhcpip.cgi.CVE-2023-43238 · Other software · dlink · reported by MITRECritical 9.8
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter nvmacaddr in form2Dhcpip.cgi.
- Product
- dir-816_a2_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2023DHCP Server Service Denial of Service VulnerabilityCVE-2023-38162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
DHCP Server Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023DHCP Server Service Information Disclosure VulnerabilityCVE-2023-38152 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
DHCP Server Service Information Disclosure Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023DHCP Server Service Information Disclosure VulnerabilityCVE-2023-36801 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
DHCP Server Service Information Disclosure Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 10, 2023A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote CodeCVE-2023-38034 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.8
A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.53 and earlier) All UniFi Switches (Version 6.5.32 and earlier) -USW Flex Mini excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update UniFi Switches to Version 6.5.59 or later.
- Product
- UniFi Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comcommunity.ui.com
Aug 8, 2023TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cste_modules/lan.so.CVE-2023-40042 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code.
- Product
- t10_v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023DHCP Server Service Information Disclosure VulnerabilityCVE-2023-29355 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
DHCP Server Service Information Disclosure Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 5, 2023On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.CVE-2023-24510 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.5
On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.
- Product
- Arista EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router ManagerCVE-2023-32955 · Network & remote access · Synology · reported by security@synology.comHigh 8.1
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows man-in-the-middle attackers to execute arbitrary commands via unspecified vectors.
- Product
- Synology Router Manager (SRM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Apr 12, 2023client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow aCVE-2023-28488 · Other software · Intel · reported by MITREMedium 6.5
client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.
- Product
- Connman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkernel.googlesource.com
Apr 11, 2023DHCP Server Service Remote Code Execution VulnerabilityCVE-2023-28231 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
DHCP Server Service Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 6, 2023TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.CVE-2023-26848 · Other software · Totolink · reported by MITRECritical 9.8
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
- Product
- A7100ru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromDhcpListClient function.CVE-2023-25219 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromDhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
- Product
- Ac5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool.CVE-2022-46415 · Other software · DJI · reported by MITRECritical 9.1
DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets.
- Product
- Spark Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsmartstore.naver.com
Mar 23, 2023A vulnerability in the IPv6 DHCP (DHCPv6) client module of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, CiscCVE-2023-20081 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
A vulnerability in the IPv6 DHCP (DHCPv6) client module of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cisco IOS Software, and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of DHCPv6 messages. An attacker could exploit this vulnerability by sending crafted DHCPv6 messages to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: To successfully exploit this vulnerability, the attacker would need to either control the DHCPv6 server or be in a man-in-the-middle position.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 23, 2023A vulnerability in the IPv6 DHCP version 6 (DHCPv6) relay and server features of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker tCVE-2023-20080 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the IPv6 DHCP version 6 (DHCPv6) relay and server features of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to insufficient validation of data boundaries. An attacker could exploit this vulnerability by sending crafted DHCPv6 messages to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 13, 2023A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1.0 parameter to lan.CVE-2023-25283 · Other software · Dlink · reported by MITREHigh 7.5
A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1.0 parameter to lan.asp.
- Product
- Dir-820l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules.CVE-2023-25395 · Other software · Totolink · reported by MITRECritical 9.8
TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules.
- Product
- A7100ru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5CVE-2022-29054 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 3.3
A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Feb 16, 2023TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.CVE-2023-24238 · Other software · Totolink · reported by MITRECritical 9.8
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
- Product
- A7100ru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.CVE-2023-24236 · Other software · Totolink · reported by MITRECritical 9.8
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
- Product
- A7100ru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcpplus.CVE-2023-24347 · Other software · Dlink · reported by MITREHigh 8.8
D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcpplus.
- Product
- Dir-605l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetWanDhcpplus.CVE-2023-24345 · Other software · Dlink · reported by MITREHigh 8.8
D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetWanDhcpplus.
- Product
- Dir-605l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.