CVE-2018-10822

Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.

• CWE-22

• http://sploit.tech/2018/10/12/D-Link.htmlExploit
• https://seclists.org/fulldisclosure/2018/Oct/36Exploit, Mailing List, Third Party Advisory
• http://sploit.tech/2018/10/12/D-Link.htmlExploit
• https://seclists.org/fulldisclosure/2018/Oct/36Exploit, Mailing List, Third Party Advisory

Published

Oct 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10813In Dedos-web 1.0, the cookie and session secrets used in the…
• CVE-2018-10814Synametrics SynaMan 4.0 build 1488 uses cleartext password s…
• CVE-2018-10815An issue was discovered in Cloudera Manager before 5.13.4, 5…
• CVE-2018-10817Severalnines ClusterControl before 1.6.0-4699 allows XSS.
• CVE-2018-1082A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. I…
• CVE-2018-10821Cross-site scripting (XSS) vulnerability in backend/pages/mo…4.8
• CVE-2018-10823An issue was discovered on D-Link DWR-116 through 1.06, DWR-…8.8
• CVE-2018-10824An issue was discovered on D-Link DWR-116 through 1.06, DIR-…9.8
• CVE-2018-10825Mimo Baby 2 devices do not use authentication or encryption …
• CVE-2018-10827LiteCart before 2.1.2 allows remote attackers to cause a den…
• CVE-2018-10828An issue was discovered in Alps Pointing-device Driver 10.1.…
• CVE-2018-1083Zsh before version 5.4.2-test-1 is vulnerable to a buffer ov…