CVE-2019-10042

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-100448.8Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph atta CVE-2019-100456.5The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scr CVE-2019-100465.3An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license inf CVE-2019-100475.4A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file p CVE-2019-100487.2The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of u CVE-2019-100497.3It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into op CVE-2019-10057.5A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerabil CVE-2019-100507.5A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed on CVE-2019-100517.5An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { ft.new_chunk }" item, CVE-2019-100527.5An issue was discovered in Suricata 4.1.3. If the network packet does not have the right length, the parser tries to access a part of a DHCP CVE-2019-100539.8An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then CVE-2019-100547.5An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an inv