ASUS RT-N53 Command Injection Vulnerability

ASUS RT-N53 is a driver application from Asus Taiwan, China. A security vulnerability exists in ASUS RT-N53 version 3.0.0.4.376.3754, which originates from a command injection in the SystemCmd parameter of the apply.cgi interface...

PT-2022-20965

Name of the Vulnerable Software and Affected Versions ASUS RT-N53 version 3.0.0.4.376.3754 Description The issue is related to a command injection vulnerability. This vulnerability is located in the SystemCmd parameter of the "apply.cgi" interface. Recommendations For ASUS RT-N53 version...

CVE-2022-31874: Improper Neutralization of Special Elements used in a Command

ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface...

CVE-2022-27280

InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting XSS vulnerability via the webexec parameter at /apply.cgi...

CVE-2022-27280

InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting XSS vulnerability via the webexec parameter at /apply.cgi...

CVE-2022-27280

The CVE-2022-27280 issue affects InHand Networks InRouter 900 Industrial 4G Router. A stored cross-site scripting (XSS) vulnerability exists in the web_exec parameter of the /apply.cgi endpoint. Affected versions are prior to 1.0.0.r11700. Root cause is unvalidated input being processed in the we...

PT-2022-18354 · Inhand Networks · Inrouter 900 Industrial 4G Router

Name of the Vulnerable Software and Affected Versions: InHand Networks InRouter 900 Industrial 4G Router versions prior to 1.0.0.r11700 Description: The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability can be exploited via the web exec parameter at the...

CVE-2022-27280: Improper Neutralization of Input During Web Page Generation

InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting XSS vulnerability via the webexec parameter at /apply.cgi...

CVE-2021-28841

Null Pointer Dereference vulnerability in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service by sending a POST request to applycgi via an action pingtest without a pingipaddr key...

CVE-2021-25310

The administration web interface on Belkin Linksys WRT160NL 1.0.04.002US20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the uilanguage POST parameter to the apply.cgi form endpoint. This occurs in doupgradepost in...

CVE-2021-25310

The administration web interface on Belkin Linksys WRT160NL 1.0.04.002US20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the uilanguage POST parameter to the apply.cgi form endpoint. This occurs in doupgradepost in...

PT-2021-16511 · Belkin · Belkin Linksys Wrt160Nl

Name of the Vulnerable Software and Affected Versions: Belkin Linksys WRT160NL version 1.0.04.002 US 20130619 Description: The administration web interface on Belkin Linksys WRT160NL devices allows remote authenticated attackers to execute system commands with root privileges via shell...

CVE-2021-25310: Improper Neutralization of Special Elements used in an OS Command

The administration web interface on Belkin Linksys WRT160NL 1.0.04.002US20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the uilanguage POST parameter to the apply.cgi form endpoint. This occurs in doupgradepost in...

PT-2020-17236

Name of the Vulnerable Software and Affected Versions RT-AC88U Download Master version 3.1.0.107 and earlier Description An information disclosure issue exists, allowing direct access to "/downloadmaster/dm apply.cgi?action mode=initial&download type=General&special cgi=get language" which can...

D-Link DAP-1520 Buffer Overflow Vulnerability

The D-Link DAP-1520 is a wireless access point product from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the apply.cgi file in versions prior to D-Link DAP-1520 1.10b04Beta02. The vulnerability originates when a network system or product performs an operation on memory...

CVE-2020-15892

An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length...

CVE-2020-15892: Incorrect Resource Transfer Between Spheres

An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length...

TRENDnet TEW-827DRU Command Injection Vulnerability (CNVD-2020-33478)

The TRENDnet TEW-827DRU is a wireless router from TRENDnet. A command injection vulnerability exists in the apply.cgi file in the TRENDnet TEW-827DRU 2.06B04 and earlier versions. An attacker can exploit this vulnerability to run arbitrary commands on the device...

TRENDnet TEW-827DRU Command Injection Vulnerability (CNVD-2020-33483)

The TRENDnet TEW-827DRU is a wireless router from TRENDnet. A command injection vulnerability exists in the apply.cgi file in the TRENDnet TEW-827DRU 2.06B04 and earlier versions. An attacker can exploit this vulnerability to run arbitrary commands on the device...

Stack overflow

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action stdevconnect, stdevdisconnect, or stdevrconnect with a sufficiently long wantype key...