CVE-2020-14077

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action setstaenrolleepinwifi1 or setstaenrolleepinwifi0 with a sufficiently long wpsstaenrolleep...

CVE-2020-14078

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action wificaptiveportallogin with a sufficiently long REMOTEADDR key...

CVE-2020-14079

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action autoupfw or autouplp with a sufficiently long updatefilename key...

CVE-2020-14081

TRENDnet TEW-827DRU routers (firmware up to 2.06B04) contain a command injection in apply.cgi via the action send_log_email using the auth_acname or auth_passwd parameter. An authenticated user can execute arbitrary commands on the device. The affected component is the apply.cgi handling in TEW-8...

CVE-2020-14077: Out-of-bounds Write

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action setstaenrolleepinwifi1 or setstaenrolleepinwifi0 with a sufficiently long wpsstaenrolleep...

PT-2020-13880

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions through 2.06B04 Description The issue concerns command injections in the apply.cgi file via specific actions, including pppoe connect, ru pppoe connect, or dhcp connect, with the key wan ifname or wan0 dns, allowin...

PT-2020-13886

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions through 2.06B04 Description The issue concerns command injections in the apply.cgi endpoint via the action send log email with the keys auth acname or auth passwd, allowing an authenticated user to run arbitrary...

CVE-2020-14076: Out-of-bounds Write

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action stdevconnect, stdevdisconnect, or stdevrconnect with a sufficiently long wantype key...

CVE-2020-14075: Improper Neutralization of Special Elements used in an OS Command

TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoeconnect, rupppoeconnect, or dhcpconnect with the key wanifname or wan0dns, allowing an authenticated user to run arbitrary commands on the device...

CVE-2020-14078: Out-of-bounds Write

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action wificaptiveportallogin with a sufficiently long REMOTEADDR key...

CVE-2020-14079: Out-of-bounds Write

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action autoupfw or autouplp with a sufficiently long updatefilename key...

CVE-2020-14081: Improper Neutralization of Special Elements used in an OS Command

TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action sendlogemail with the key authacname or authpasswd, allowing an authenticated user to run arbitrary commands on the device...

PT-2020-13884

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions through 2.06B04 Description The issue is a stack-based buffer overflow in the ssi binary, allowing an authenticated user to execute arbitrary code. This can be achieved by sending a POST request to the "apply.cgi"...

PT-2020-13881

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions through 2.06B04 Description The issue concerns a stack-based buffer overflow in the ssi binary, allowing an authenticated user to execute arbitrary code. This can be achieved by sending a POST request to the...

CVE-2020-14074: Out-of-bounds Write

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action kickbanwifimacallow with a sufficiently long qcawifi.wifi0vap0.maclist key...

PT-2020-13879

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions through 2.06B04 Description The issue is a stack-based buffer overflow in the ssi binary, allowing an authenticated user to execute arbitrary code. This can be achieved by sending a POST request to the "apply.cgi"...

PT-2020-13882

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions through 2.06B04 Description The issue is a stack-based buffer overflow in the ssi binary, allowing an authenticated user to execute arbitrary code. This can be achieved by sending a POST request to the "apply.cgi"...

PT-2020-13883

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions through 2.06B04 Description The issue is a stack-based buffer overflow in the ssi binary, allowing an authenticated user to execute arbitrary code. This can be achieved by sending a POST request to the "apply.cgi"...

CVE-2013-2679

Multiple cross-site scripting XSS vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inject arbitrary web script or HTML via the 1 logtype, 2 pingip, 3 pingsize, 4 submittype, or 5 tracerouteip parameter to apply.cgi or 6 newworkgroup or 7...

PT-2020-7413

Name of the Vulnerable Software and Affected Versions: Cisco Linksys E4200 router version 1.0.05 build 7 Description: Multiple cross-site scripting XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via vulnerable parameters. The affected parameters include log type...