TP-Link-Archer-CR-700-XSS-Exploit

TP-Link-Archer-CR-700-XSS-Exploit TP-Link Archer CR-700 라우터 익스플로잇. TP-Link에 책임 공개됨 1단계- Linux 머신Kali 또는 Ubuntu에서 다음 명령을 입력하세요. gedit /etc/dhcp/dhclient.conf 아래 줄을 주석 처리하세요. send host-name = gethostname; 그 줄을 그 아래 줄에 복사하고 gethostname 함수를 아래와 같이 XSS 스크립트로 변경하세요. send host-name = "alert5"; 2단계: 변경 사...

CVE-2026-33272

The Red Lion Controls N-Tron 700 Series switch is vulnerable to an authentication bypass via an alternate path or channel (CWE-288 ). A malicious user with physical access to the device can boot the switch from factory settings without authentication. Once booted, the attacker can use default adm...

CVE-2026-33272 Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

CVE-2026-39453

The Red Lion Controls N-Tron 700 Series switch is vulnerable to a Reachable Assertion (CWE-617) flaw. Navigating to a specific URL on the device's web server triggers an automatic reboot. An attacker can automate this action using tools like curl to create a persistent Denial of Service (DoS) con...

CVE-2026-39453 Red Lion Controls N-Tron 700 Series Reachable Assertion

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots...

CVE-2026-29797

The Red Lion Controls N-Tron 700 Series is vulnerable to a Download of Code Without Integrity Check (CWE-494). The root cause is a lack of authentication requirements when updating the firmware or bootloader , which allows attackers to push malicious files to the device. Furthermore, individuals ...

CVE-2026-29797 Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP...

CVE-2026-33367

The Red Lion Controls N-Tron 700 Series is vulnerable to a missing authentication flaw where SNMP can be used to perform administrative actions. Attackers can retrieve configuration files, modify user accounts or device settings, and initiate firmware or bootloader upgrades/downgrades without any...

CVE-2026-33367 Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication...

CVE-2026-28745

The Red Lion Controls N-Tron 700 Series is vulnerable to insecure credential storage. Specifically, usernames and passwords—including default credentials —are saved in the configuration file using weak encryption . A malicious actor who knows the default credentials could potentially recover othe...

CVE-2026-28745 Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system...

CVE-2026-39460

The Red Lion Controls N-Tron 700 Series is vulnerable to insufficiently protected credentials because usernames and passwords, including default factory credentials, are stored in plaintext within the configuration file. An attacker with administrator rights can view this file via the CLI or expo...

CVE-2026-39460 Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP...

CVE-2026-32645

The Red Lion Controls N-Tron 700 Series is affected by a vulnerability involving the use of hard-coded credentials . Specifically, default factory credentials with administrative access remain active and persist even after additional administrator accounts have been configured. This flaw allows f...

CVE-2026-32645 Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts...

CVE-2026-19948: Missing Authorization

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-75019: Improper Neutralization of Input During Web Page Generation

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

CVE-2026-16771

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the...

CVE-2026-16771 CVE-2026-16771

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the...

PT-2026-65570

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the...