PT-2018-4285

Name of the Vulnerable Software and Affected Versions Aztech ADSL DSL5018EN 1T1R version not specified Aztech ADSL DSL705E version not specified Aztech ADSL DSL705EU version not specified Description The issue is related to the cgi-bin/AZ Retrain.cgi endpoint, which does not check for...

Innotube ITGuard-Manager cgi-bin/drknow.cgi file remote code execution vulnerability

Innotube ITGuard-Manager is an IT asset management system. A security vulnerability exists in the cgi-bin/drknow.cgi file in Innotube ITGuard-Manager version 0.0.0.1. The vulnerability can be exploited by a remote attacker to execute arbitrary operating system commands via shell metacharacters in...

Design/Logic Flaw

cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, as demonstrated by a username beginning with "admin|" to use the '|' metacharacter...

CVE-2017-18025: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, as demonstrated by a username beginning with "admin|" to use the '|' metacharacter...

PT-2018-1051

Name of the Vulnerable Software and Affected Versions Innotube ITGuard-Manager version 0.0.0.1 Description The issue is related to the execution of arbitrary OS commands via shell metacharacters in the username field of the cgi-bin/drknow.cgi script. This can be exploited by remote attackers,...

Meinberg LANTIME Web Configuration Utility Arbitrary File Read Vulnerability

Meinberg LANTIME is an NTP time server from Meinberg, Germany.Web Configuration Utility is one of the web configuration utilities. A security vulnerability exists in the Web Configuration Utility on Meinberg LANTIME with firmware prior to version 6.24.004. A remote attacker can exploit the...

Multi-Product Anti-We Remote Command Execution Vulnerability

NetBiter/HMS, etc. are gateway devices made by different companies. anti-Web is one of the anti-virus components used in them. A security vulnerability exists in the cgi-bin/write.cgi file of Anti-Web 3.8.7 and earlier versions in several products. The vulnerability can be exploited by remote...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-17888: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

PT-2017-15075

Name of the Vulnerable Software and Affected Versions Anti-Web through version 3.8.7 Description The issue allows remote authenticated users to execute arbitrary OS commands via crafted multipart/form-data content. This affects devices from various manufacturers, including NetBiter / HMS, Ouman...

Open redirect

TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd...

CVE-2017-17757

TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd...

CVE-2017-17758

CVE-2017-17758 affects TP-Link TL-WVR and TL-WAR devices. A remote authenticated user can execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, tied to zone_get_iface_bydev in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd. C...

CVE-2017-17757

CVE-2017-17757 affects TP-Link TL-WVR and TL-WAR devices. The vulnerability exists in the uhttpd web interface (admin/wportal) via shell metacharacters in the interface field passed to cgi-bin/luci, related to get_device_byif in /usr/lib/lua/luci/controller/admin/wportal.lua, allowing remote auth...

CVE-2017-17105: Improper Neutralization of Special Elements used in an OS Command

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 and possibly in-between versions web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a...

PT-2017-14559

Name of the Vulnerable Software and Affected Versions Meinberg LANTIME devices with firmware prior to 6.24.004 Description The issue allows remote authenticated users with certain privileges to read arbitrary files. This can be achieved via the ntpclientcounterlogfile parameter to "cgi-bin/mainv2...

PT-2017-14989

Name of the Vulnerable Software and Affected Versions TP-Link TL-WVR and TL-WAR devices affected versions not specified Description The issue allows remote authenticated users to execute arbitrary commands by injecting shell metacharacters in the interface field of an admin/dhcps command to the...

TP-Link TL-WVR and TL-WAR Arbitrary Command Execution Vulnerability

TP-Link TL-WVR and TL-WAR are both wireless router products from China P&L TP-LINK. A security vulnerability exists in the TP-Link TL-WVR and TL-WAR. The vulnerability can be exploited by a remote attacker to execute arbitrary commands by sending the admin/wportal command with shell metacharacter...

PT-2017-14988

Name of the Vulnerable Software and Affected Versions TP-Link TL-WVR and TL-WAR devices affected versions not specified Description The issue allows remote authenticated users to execute arbitrary commands by injecting shell metacharacters in the interface field of an admin/wportal command to the...