Design/Logic Flaw

TOTOLINK EX1200L V9.3.5u.6146B20201023 is vulnerable to arbitrary command execution on the cstecgi.cgi NTPSyncWithHost interface...

Command injection

TOTOlink EX1800T v9.1.0cu.2112B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘key5g’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi...

Command injection

TOTOlink EX1200L V9.3.5u.6146B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi setOpModeCfg interface...

Command injection

TOTOlink EX1200L V9.3.5u.6146B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi UploadFirmwareFile interface...

CVE-2023-51023

TOTOlink EX1800T v9.1.0cu.2112B20220316 is vulnerable to arbitrary command execution in the ‘hosttime’ parameter of the NTPSyncWithHost interface of the cstecgi .cgi...

CVE-2023-51024

TOTOlink EX1800T v9.1.0cu.2112B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘tz’ parameter of the setNtpCfg interface of the cstecgi .cgi...

Command injection

TOTOlink EX1800T V9.1.0cu.2112B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘hour’ parameter of the setRebootScheCfg interface of the cstecgi .cgi...

CVE-2023-51025

CVE-2023-51025 affects TOTOLINK EX1800T v9.1.0cu.2112_B20220316. The vulnerability is an unauthorized arbitrary command execution in the admuser parameter of the setPasswordCfg interface of the cstecgi.cgi, caused by inadequate filtering of constructed commands. Impact is high (arbitrary commands...

CVE-2023-51023

CVE-2023-51023 affects TOTOLINK EX1800T (v9.1.0cu.2112_B20220316) with the NTPSyncWithHost interface’s cstecgi.cgi. The root cause is failure to properly filter constructed command characters in the host_time parameter, enabling arbitrary command execution on the device. Impact is consistent with...

PT-2023-31740 · Totolink · Totolink Ex1800T

Name of the Vulnerable Software and Affected Versions: TOTOlink EX1800T version 9.1.0cu.2112 B20220316 Description: The issue concerns an unauthorized arbitrary command execution in the admuser parameter of the "setPasswordCfg" interface of the cstecgi .cgi. This allows for potential exploitation...

PT-2023-31745 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOlink EX1200L version 9.3.5u.6146 B20201023 Description: The issue allows for arbitrary command execution via the "cstecgi.cgi" interface, specifically through the setOpModeCfg function. This could potentially be exploited through the...

PT-2023-31483 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOlink A3700R router device version V9.1.2u.5822 B20200513 Description: The issue is related to an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi. This vulnerability affects the TOTOlink A3700R...

CVE-2023-51015

TOTOLINX EX1800T v9.1.0cu.2112B20220316 is vulnerable to arbitrary command execution in the ‘enable parameter’ of the setDmzCfg interface of the cstecgi .cgi...

CVE-2023-51024

TOTOlink EX1800T v9.1.0cu.2112B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘tz’ parameter of the setNtpCfg interface of the cstecgi .cgi...

CVE-2023-50147

There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822B20200513...

Palo Alto Networks PAN-OS XML API Command Injection Vulnerability

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. Palo Alto Networks PAN-OS suffers from a command injection vulnerability that stems from a failure to properly filter construct command special characters, commands, etc. in the XML API. An attacker cou...

CVE-2023-51018

TOTOlink EX1800T v9.1.0cu.2112B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘opmode’ parameter of the setWiFiApConfig interface of the cstecgi .cgi...

CVE-2023-51034

TOTOlink EX1200L V9.3.5u.6146B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi UploadFirmwareFile interface...

CVE-2023-51026

TOTOlink EX1800T V9.1.0cu.2112B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘hour’ parameter of the setRebootScheCfg interface of the cstecgi .cgi...

CVE-2023-50147

The CVE-2023-50147 entry concerns the TOTOLINK A3700R router, firmware version V9.1.2u.5822_B20200513, with a vulnerability in the setDiagnosisCfg function of the cstecgi.cgi. The issue enables arbitrary command execution, as described across multiple sources. Affected component: cstecgi.cgi’s se...