PT-2024-1579

Name of the Vulnerable Software and Affected Versions Totolink X2000R version 1.0.0-B20221212.1452 Description The issue is related to a buffer overflow vulnerability in the formTmultiAP function of the /bin/boa file. This vulnerability can be exploited remotely, allowing an attacker to execute...

CVE-2023-7208

A vulnerability classified as critical was found in Totolink X2000RV2 2.0.0-B20230727.10434. This vulnerability affects the function formTmultiAP of the file /bin/boa. The manipulation leads to buffer overflow. VDB-249742 is the identifier assigned to this vulnerability. NOTE: The vendor was...

Buffer overflow

A vulnerability classified as critical was found in Totolink X2000RV2 2.0.0-B20230727.10434. This vulnerability affects the function formTmultiAP of the file /bin/boa. The manipulation leads to buffer overflow. VDB-249742 is the identifier assigned to this vulnerability. NOTE: The vendor was...

CVE-2023-7208: Buffer Copy without Checking Size of Input

A vulnerability classified as critical was found in Totolink X2000RV2 2.0.0-B20230727.10434. This vulnerability affects the function formTmultiAP of the file /bin/boa. The manipulation leads to buffer overflow. VDB-249742 is the identifier assigned to this vulnerability. NOTE: The vendor was...

TOTOLINK X2000R 安全漏洞

TOTOLINK X2000R is a wireless router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK X2000R X2000RV2 version 2.0.0-B20230727.10434. The vulnerability stems from the formTmultiAP function in file /bin/boa failing to properly validate the length size of th...

PT-2024-15231

Name of the Vulnerable Software and Affected Versions Totolink X2000R V2 version 2.0.0-B20230727.10434 Description A critical vulnerability was found in the Totolink X2000R V2, affecting the function formTmultiAP of the file /bin/boa. The manipulation leads to buffer overflow. The vendor was...

VulnCheck KEV: CVE-2017-9833

/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue e.g., a vulnerability on one type of camera because Boa does not include any...

boa file Code Execution

The vulnerability of the boa parameter file in the goform/formSetWanDhcpplus software for D-Link N300 WI-Fi Router DIR-605L wireless access points is related to the ability to write data beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary...

D-Link Router Arbitrary Command Execution

The vulnerability of the /bin/boa microprogramming system components of D-Link’s DIR-619L and DIR-605L routers lies in the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

D-Link Router Code Execution

The vulnerability of the /bin/boa component of D-Link DIR-823G router microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remote...

Boa Web Server v0.94.14 - Authentication Bypass

Exploit Title: Boa Web Server v0.94.14 - Authentication Bypass Date: 19-11-2022 Exploit Author: George Tsimpidas Vendor: https://github.com/gpg/boa CVE: N/A Tested on: Debian 5.18.5 Description : Boa Web Server Versions from 0.94.13 - 0.94.14 fail to validate the correct security constraint on th...

DIR-605L Router Buffer Overflow

The vulnerability of the DIR-605L router’s microprogramming software is related to buffer overflows during the processing of BOA binary files in the bin directory. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause service failures...

VulnCheck KEV: CVE-2021-33558

Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not par...

CVE-2021-31576

In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB001232...

CVE-2021-31577

In Boa, there is a possible escalation of privilege due to a missing permission check. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID:...

CVE-2021-31578

In Boa, there is a possible escalation of privilege due to a stack buffer overflow. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID:...

CVE-2021-31577

In Boa, there is a possible escalation of privilege due to a missing permission check. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID:...

CVE-2021-31576

In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB001232...

CVE-2021-31578

In Boa, there is a possible escalation of privilege due to a stack buffer overflow. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID:...

CVE-2021-31576

In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB001232...