Cross site scripting

Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 a...

Command injection

OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows:...

CVE-2023-39429

Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 a...

CVE-2023-39222

OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows:...

Moxa EDR-810 Unauthenticated Remote Code Execution with Root Privileges (CVE-2018-16282)

A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/netWebCADELETEGetValue URI. This plugin only works with Tenable.ot. Please visit...

Moxa EDR-810 Web Server OpenVPN Config Command Injection (CVE-2017-14434)

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetmask0= parameter in the...

Moxa EDR-810 Web Server URI Denial of Service (CVE-2017-12124)

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in the web server crashing. An attacker can send a crafted URI to trigger this vulnerability. This...

Moxa EDR-810 Web Server Certificate Signing Request Command Injection (CVE-2017-12125)

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the CN= parm in the /goform/netWebCSRGen uri t...

Moxa EDR-810 Service Agent Denial of Service (CVE-2017-14439)

Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4001/tcp to trigger this vulnerability. This plugin only works with...

Moxa EDR-810 Service Agent Denial of Service (CVE-2017-14438)

Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4000/tcp to trigger this vulnerability. This plugin only works with...

Moxa EDR-810 Cleartext Transmission of Password (CVE-2017-12123)

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin. Th...

Moxa EDR-810 Web Server strcmp Denial of Service (CVE-2017-14437)

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to /MOXA\LOG.ini without a cookie header ...

Moxa EDR-810 Industrial Secure Router Privilege Escalation (CVE-2016-8346)

An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to access configuration and log files PRIVILEGE ESCALATION. This plugin only works with Tenable.ot. Please visit...

Moxa EDR-810 Server Agent Information Disclosure (CVE-2017-12128)

An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packet can cause information disclosure. An attacker can send a crafted TCP packet to trigger this vulnerability. This plugin only works with...

Moxa EDR-810 Web Server OpenVPN Config Command Injection (CVE-2017-14433)

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetwork0= parameter in the...

Moxa EDR-810 Web Server ping Command Injection (CVE-2017-12120)

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation, resulting in a root shell. An attacker can inject OS commands into the ip= parm in the...

Moxa EDR-810 Web Server strcmp Denial of Service (CVE-2017-14436)

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to /MOXA\CFG2.ini without a cookie header...

Moxa EDR-810/G902/G903 Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2020-28144)

Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code...

Moxa EDR-810 Web Server OpenVPN Config Command Injection (CVE-2017-14432)

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the openvpnServer0tmp= parameter in the...

Moxa EDR-810 Web Server Cross-Site Request Forgery (CVE-2017-12126)

An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP packet can cause cross-site request forgery. An attacker can create malicious HTML to trigger this vulnerability. This plugin only works wit...