PT-2017-14449

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description A stored Cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field,...

PT-2017-14448

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the Basic Settings screen. This allows attackers to modify settings related to the cgi-bin/update endpoint...

PT-2017-14450

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the /cgi-bin/login API endpoint. This allows attackers to authenticate a user via the login screen using the...

CVE-2017-16564: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in /cgi-bin/config2 on Vonage Grandstream HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field P148...

PT-2017-14139

Name of the Vulnerable Software and Affected Versions FiberHome routers affected versions not specified Description A Directory Traversal issue exists in the /cgi-bin/webproc endpoint via the getpage parameter in conjunction with a crafted var:page value. Recommendations At the moment, there is n...

CVE-2017-15647: Improper Limitation of a Pathname to a Restricted Directory

On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value...

FiberHome Directory Traversal

Vulnerability Summary The following advisory describes a directory traversal vulnerability found in FiberHome routers. FiberHome Technologies Group “was established in 1974. After continuous and intensive development for over 40 years, its business has been extended to R&D, manufacturing, marketi...

CVE-2017-14942: Files or Directories Accessible to External Parties

Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie...

CVE-2017-11350

Cross-Site Request Forgery CSRF exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices...

PT-2017-11951

Name of the Vulnerable Software and Affected Versions Axesstel MU553S MU55XS-V1.14 Description A Cross-Site Request Forgery CSRF issue exists in the cgi-bin/ConfigSet endpoint. This allows for potential unauthorized actions on affected devices. Recommendations For Axesstel MU553S MU55XS-V1.14,...

CVE-2017-11350: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices...

PT-2017-13331

Name of the Vulnerable Software and Affected Versions Samsung NVR devices affected versions not specified Description The issue allows remote attackers to read the MD5 password hash of the 'admin' account by sending certain szUserName JSON data to the "cgi-bin/main-cgi" API endpoint. This hash ca...

CVE-2017-14262: Inadequate Encryption Strength

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

PT-2017-13039

Name of the Vulnerable Software and Affected Versions T&W WIFI Repeater BE126 version not specified Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to "cgi-bin/webupg". Recommendations For T&W WIFI Repeater BE126,...

PT-2017-13090

Name of the Vulnerable Software and Affected Versions Lexmark Scan To Network SNF versions 3.2.9 and earlier Description The issue allows remote attackers to obtain sensitive information. This is due to network configuration credentials being stored in plaintext and transmitted in requests...

CVE-2017-13713: Improper Neutralization of Special Elements used in an OS Command

T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg...

CVE-2017-9833: Improper Limitation of a Pathname to a Restricted Directory

/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue e.g., a vulnerability on one type of camera because Boa does not include any...

PT-2017-2639

Name of the Vulnerable Software and Affected Versions VIVOTEK Network Camera IB8369, FD8164, and FD816BA affected versions not specified Description The issue is related to insufficient input processing in the /cgi-bin/admin/testserver.cgi web service of the network camera's firmware. This allows...

PT-2017-19203

Name of the Vulnerable Software and Affected Versions VIVOTEK Network Cameras affected versions not specified Description The /cgi-bin/admin/downloadMedias.cgi API endpoint of the web service in VIVOTEK Network Cameras is vulnerable, allowing remote attackers to read any file on the camera's Linu...

CVE-2017-9828: Improper Neutralization of Special Elements used in an OS Command

'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera...