CVE-2022-30525

CVE-2022-30525 Zyxel의 CGI 프로그램에서 발생한 OS 명령 주입 취약점 요약 이 취약점은 2022년 4월 13일에 처음 발견되었으며, Zyxel 방화벽 제품에서 원격 코드 실행을 유발했습니다. CVSS 점수 9.8의 중요한 취약점으로, 발견 후 15일 만에 Zyxel이 업데이트를 출시하여 차단했습니다. 이 과정에서 최소 20,800개의 모델이 영향을 받았으며, 대부분 유럽 지역이었습니다. 취약점은 제로터치 프로비저닝 애플릿 내의 "setWanPortSt" 명령어로 인해 발생합니다. "setWanPortSt"...

ctf-cve-2024-4577

CVE-2024-4577 CTF 챌린지 개요 이 CTF 챌린지는 PHP 8.1.x 8.1.21, 8.2.x 8.2.8, 8.3.x 8.3.1에 영향을 미치는 치명적인 PHP CGI 인수 삽입 취약점인 CVE-2024-4577을 시연합니다. 취약점 상세 CVE-2024-4577은 PHP가 CGI 핸들러로 실행되도록 구성될 때 발생하는 PHP CGI 인수 삽입 취약점입니다. 공격자는 조작된 HTTP 요청을 통해 PHP 인터프리터에 명령줄 인수를 주입하여 잠재적으로 원격 코드 실행으로 이어질 수 있습니다. 챌린지 설명 웹 서버에서 ...

CVE-2021-42013

CVE-2021-42013 취약한 서비스 설치 여러 옵션: 1. Docker 컨테이너 docker run -d -p 8080:80 12345qwert123456/apache2450cve-2021-42013 2. Dockerfile git clone https://github.com/12345qwert123456/CVE-2021-42013.git cd CVE-2021-42013-Vulnerable-service/2.4.50 docker build -t apache2450cve-2021-42013 . docker run -d -p...

CVE-2026-101076

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...

CVE-2026-101076

The Netcore NR289-GE (version 1.4.5102) is susceptible to a remote OS command injection vulnerability in the CGI Handler component. Specifically, the system function within the /set_ntp_server_ip.cgi file fails to properly sanitize the ntp_ip argument, allowing an attacker to execute arbitrary co...

CVE-2026-101076 Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...

EUVD-2026-88317

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...

CVE-2026-101076 Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...

CVE-2026-101072

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

EUVD-2026-88289

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-101072 Netcore NR289-GE CGI ap_ip.cgi system os command injection

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-101072

A vulnerability exists in Netcore NR289-GE 1.4.5102 within the CGI Handler component. Specifically, the /ap_ip.cgi file fails to properly handle the ip argument, which can lead to remote OS command injection . This vulnerability can be exploited over the network. An exploit is publicly available ...

CVE-2026-101072 Netcore NR289-GE CGI ap_ip.cgi system os command injection

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

PT-2026-99914

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description An OS command injection flaw exists in the CGI Handler component. A remote attacker can exploit this by manipulating the ntp ip argument within the /set ntp server ip.cgi endpoint, which affects th...

CVE-2026-101072: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-101076: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...

CVE-2026-76857

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddnswanlistshow.cgi endpoint and related DDNSsetcgi, IGDGetCgiHandler, and IGDCgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...

CVE-2026-76864

Netcore NR255-V version 1.5.130703 suffers from a stored cross-site scripting (XSS) vulnerability in its QoS management interface. QoS rule names are not sanitized before being parsed via eval() in the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi CGI handlers...

CVE-2026-76864 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval in qosxianzaddcgi, qosxianzshowcgi, qosfilteraddcgi, and qosfiltershowcgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is...

PT-2026-93199

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter conn del cgi.c and gre prio set cgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of servic...