279 matches found
Command injection
An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
Stack overflow
A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
Command injection
An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this...
Directory traversal
A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to local file inclusion. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2021-21896
A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to arbitrary file deletion. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2021-21895
Summary: CVE-2021-21895 is a directory traversal vulnerability in the Web Manager FsTFtp feature of Lantronix PremierWave 2050 (version 8.9.0.0R4, in QEMU). The flaw arises from insufficient input validation in the FsTFtp Web Manager when handling the cwd parameter, enabling an authenticated user...
CVE-2021-21895
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to FsTFtp file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2021-21894
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to arbitrary file overwrite FsTFtp file disclosure. An attacker can make an authenticated HTTP request to trigger this...
CVE-2021-21892
A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2021-21894
The CVE-2021-21894 vulnerability affects Lantronix PremierWave 2050 (Web Manager FsTFtp) and is detailed in Talos as a directory traversal flaw in FsTFtp that can be exploited by an authenticated HTTP request to perform arbitrary file disclosure/overwrite. The flaw arises from insufficient saniti...
CVE-2021-21892
Lantronix PremierWave 2050 Web Manager FsUnmount stack-based buffer overflow vulnerability (CVE-2021-21892) affects version 8.9.0.0R4 (in QEMU). Root cause: insecure use of sprintf with user-controlled path parameter during FsUnmount handling, overflowing a stack buffer and enabling remote code e...
CVE-2021-21891
A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution in the vulnerable portion of the branch deletefile. An attacker can make an...
CVE-2021-21891
CVE-2021-21891 refers to a stack-based buffer overflow in Lantronix PremierWave 2050 Web ManagerFsBrowseClean (QEMU 8.9.0.0R4). The vulnerability arises in the handling of POST parameters action, path and dir, with unchecked sprintf into a 4120-byte buffer (buff) when action is deletedir or delet...
CVE-2021-21890
A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution in the vulnerable portion of the branch deletedir. An attacker can make an...
CVE-2021-21889
A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2021-21888
The CVE-2021-21888 issue affects Lantronix PremierWave 2050 Web Manager SslGenerateCertificate. TALOS details show the Web Manager builds an OpenSSL-related certificate generation command by concatenating user-supplied HTTP POST fields (e.g., c, st, l, o, ou, cn, expires) into a command string ex...
CVE-2021-21888
An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this...
CVE-2021-21887
A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2021-21887
Summary: CVE-2021-21887 affects Lantronix PremierWave 2050 Web Manager (SslGenerateCSR). A stack-based buffer overflow arises from unbounded string concatenation in handling CSR fields via the POST parameter s, l, o, ou, cn, enabling an authenticated attacker with ssl permissions to overflow a st...
CVE-2021-21885
The CVE-2021-21885 entry concerns Lantronix PremierWave 2050 Web Manager FsMove directory traversal. Talos reports an authenticated user can abuse FsMove to bypass path restrictions and move or expose files within the device filesystem (rooted at /ltrx_user/), via manipulated cwd and dst paramete...