CVE-2019-8314

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field.

• CWE-78

• https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/qos.mdExploit, Third Party Advisory
• https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/qos.mdExploit, Third Party Advisory

Published

Feb 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-8291Online Store System v1.0 delete_file.php doesn't check to se…7.5
• CVE-2019-8292Online Store System v1.0 delete_product.php doesn't check to…5.3
• CVE-2019-8293Due to a logic error in the code, upload-image-with-ajax v1.…9.8
• CVE-2019-8308Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, expo…
• CVE-2019-8312An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8313An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8315An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8316An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8317An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8318An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8319An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8320A Directory Traversal issue was discovered in RubyGems 2.7.6…