CVE-2019-7736

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-425

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-77378.8A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit.CVE-2019-77386.5C.P.Sub before 5.3 allows CSRF via a manage.php?p=article_del&id= URI.CVE-2019-77396.1An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global Configuration. This isCVE-2019-77406.1An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an XCVE-2019-77416.1An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS.CVE-2019-77426.1An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file typesCVE-2019-77439.8An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no CVE-2019-77446.1An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerabCVE-2019-77459.8JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qcmap_web_cgi Page=GetWCVE-2019-77468.1JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmap_auth type=getuser reCVE-2019-77479.6DbNinja 3.2.7 allows session fixation via the data.php sessid parameter.CVE-2019-77486.1_includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.
CVE-2019-7736: Critical severity, CVSS 9.8 | Vulnix