87 matches found
DRA_writeup
Oracle DSR의 보안 취약점 KPN CISO REDteam KPN은 네덜란드에 위치한 통신 사업자입니다. CISO REDteam은 2013년에 도입된 KPN의 윤리적 해킹 팀입니다. 이 팀은 KPN 애플리케이션 및 서비스의 보안 테스트에 참여하여 고객 데이터가 무단 액세스, 수정 및 데이터 손실로부터 안전하게 보호되도록 합니다. Diameter Routing Agent 배경 KPN은 네덜란드에서 가장 큰 모바일 네트워크를 운영합니다. KPN이 운영하는 4G 네트워크의 구성 요소 중 하나는 Oracle Diameter...
CVE-2026-52200
UZ801 / ES-U3TS MifiService 취약한 접근 제어 OEM / 화이트 라벨 UZ801v2.1 4G LTE 모바일 Wi-Fi 플랫폼시장에서는 ES-U3TS로도 판매 확인됨의 MifiService.apk가 노출하는 임베디드 웹 관리 API의 취약한 접근 제어 문제에 대한 보안 권고 및 기술 노트입니다. 이 저장소는 조율된 공개coordinated disclosure 및 CVE 할당을 지원하기 위한 것입니다. 재현 가능하고 비무기화된 기술 증거에 중점을 둡니다. 요약 영향을 받는 장치는 다음 주소에서 Jetty 기반...
CVE-2026-52199: Improper Neutralization of Special Elements used in a Command
An issue in Generic OEM UZ801v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component...
CVE-2026-52200: Improper Control of Generation of Code
An issue in Generic OEM UZ801v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk...
CVE-2021-47740: Insufficient Session Expiration
KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. Attackers can exploit the weak session handling to maintain unauthorized access and potentially compromise device authentication mechanisms...
CVE-2025-68706: Stack-based Buffer Overflow
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attack...
CVE-2025-41108: Improper Authentication
The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station tablet and gaining unauthorised full control of the robot. The absence of encryption and authenticati...
EUVD-2019-14912
Malware in sbrugna...
EUVD-2022-34052
Malicious code in bioql PyPI...
EUVD-2024-53553
Malicious code in bioql PyPI...
CVE-2025-57278: Improper Authentication
The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800B10ALKSLV01.01.02P42U1406 does not implement proper session handling. After a user authenticates from a specific IP address, the router grants access to any other client using that same IP, without requiring credentials or...
CVE-2024-53946: Cross-Site Request Forgery (CSRF)
The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery CSRF on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in...
CVE-2025-29653
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2025-29653
TP-Link M7450 4G LTE Mobile Wi‑Fi Router is affected by CVE-2025-29653 as reported in multiple sources (Red Hat and PT-2025-16890). The vulnerability is a SQL Injection in firmware version 1.0.2 Build 170306 Rel.1015n, exploitable via the username and password fields. The PT-2025-16890 descriptio...
PT-2025-16882 · Tp Link · Tp-Link M7200
Name of the Vulnerable Software and Affected Versions: TP-Link M7200 4G LTE Mobile Wi-Fi Router version 1.0.7 Build 180127 Rel.55998n Description: A SQL Injection issue exists, allowing an unauthenticated attacker to inject malicious SQL statements via the username and password fields. This issue...
PT-2025-16889 · Tp Link · Tp-Link M7000
Name of the Vulnerable Software and Affected Versions: TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware version 1.0.7 Build 180127 Rel.55998n Description: A SQL Injection vulnerability exists in the TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware, allowing an unauthenticated attacker to inject...
CVE-2024-57238
Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/procget endpoint. The vulnerability allows an attacker to manipulate SQL queries by injecting malicious SQL code into the orderby parameter...