CVE-2014-7857

D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter, and setting the spawned session's cookie to username=admin.

• CWE-287

• http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/May/125Mailing List, Third Party Advisory, VDB Entry
• http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdfTechnical Description
• http://www.securityfocus.com/archive/1/535626/100/200/threaded
• http://www.securityfocus.com/bid/74880Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/May/125Mailing List, Third Party Advisory, VDB Entry
• http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdfTechnical Description
• http://www.securityfocus.com/archive/1/535626/100/200/threaded
• http://www.securityfocus.com/bid/74880Third Party Advisory, VDB Entry

Published

Aug 25, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-7851oVirt 3.2.2 through 3.5.0 does not invalidate the restapi se…
• CVE-2014-7852Cross-site scripting (XSS) vulnerability in JBoss RichFaces,…
• CVE-2014-7853The JBoss Application Server (WildFly) JacORB subsystem in R…
• CVE-2014-7854Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-7855Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-7856Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-7858The check_login function in D-Link DNR-326 before 2.10 build…
• CVE-2014-7859Stack-based buffer overflow in login_mgr.cgi in D-Link firmw…
• CVE-2014-7860The web/web_file/fb_publish.php script in D-Link DNS-320L be…
• CVE-2014-7861The IOHIDSecurePromptClient function in Apple OS X does not …
• CVE-2014-7862The DCPluginServelet servlet in ManageEngine Desktop Central…
• CVE-2014-7863The FailOverHelperServlet (aka FailServlet) servlet in ZOHO …7.5