I-O DATA WN-AX1167GR Buffer Overflow Vulnerability (CNVD-2017-20143)

The I-O DATA DEVICE WN-AX1167GR is a wireless router product from I-O DATA DEVICE Japan. A buffer overflow vulnerability exists in the WN-AX1167GR using firmware version 3.00 and earlier. An attacker can exploit this vulnerability to execute arbitrary commands...

I-O DATA DEVICE WN-G300R3 Hardcoded Credential Vulnerability

The I-O DATA DEVICE WN-G300R3 is a wireless router device from I-O DATA DEVICE Japan. A hard-coded credentials vulnerability exists in the I-O DATA DEVICE WN-G300R3 using firmware version 1.0.2 and earlier, which stems from the program's use of hard-coded credentials. An attacker could exploit th...

Green Packet DX-350 Cross-Site Request Forgery Vulnerability

The Green Packet DX-350 is a network access point device from Green Packet USA. A cross-site request forgery vulnerability exists in the Green Packet DX-350 using firmware version 2.8.9.5-g1.4.8-atheeb. A remote attacker can exploit this vulnerability by sending a request to the ajax.cgi file to...

CVE-2017-2273

Cross-site request forgery CSRF vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2017-9931

Cross-Site Scripting XSS exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by the action parameter to ajax.cgi...

CVE-2017-9931

Cross-Site Scripting XSS exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by the action parameter to ajax.cgi...

CVE-2017-9932

Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account...

BUFFALO WAPM-1166D and WAPM-APG600H Authentication Bypass Vulnerabilities

The BUFFALO WAPM-1166D and WAPM-APG600H are both wireless LAN access point devices from BUFFALO Japan. A security vulnerability exists in the WAPM-1166D using firmware version 1.2.7 and earlier and the WAPM-APG600H using firmware version 1.16.1 and earlier. A remote attacker can exploit this...

Belkin NetCam F7D7601 Remote Command Execution / Hard-Coded Passwords

Exploit Title: Belkin NetCam F7D7601 | Remote Command Execution Date: 17/07/17 Exploit Author: Wadeek Vendor Homepage: http://www.belkin.com/ Tested on: Belkin NetCam F7D7601 WeMoNetCamWW2.00.10684.PVT ================================================ UnsetupMode == 0 Hard-coded password admin:adm...

CVE-2017-2184

Buffer overflow in HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to execute arbitrary code via WebUI...

Teltonika RUT9XX Router Arbitrary Command Execution Vulnerability

Teltonika RUT9XX routers also known as LuCI is a router product from the Lithuanian company Teltonika. A security vulnerability exists in the administration interface of Teltonika RUT9XX routers with firmware version 00.03.265 and earlier. The vulnerability can be exploited by a remote attacker t...

Brother Industries MFC-J960DWN Cross-Site Request Forgery Vulnerability

The Brother Industries MFC-J960DWN is a printer from Brother Industries in Japan. A cross-site request forgery vulnerability exists in the Brother Industries MFC-J960DWN using firmware version D and earlier. A remote attacker could exploit this vulnerability to perform unauthorized operations...

Foscam C1 Indoor HD Camera cgiproxy.fcgi SMTP Parameter Configuration Command Injection Vulnerability

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A security vulnerability exists in the Foscam C1 Indoor HD Camera using application firmware version 2.52.2.37. An attacker can exploit the vulnerability by sending a specially crafted HTTP request to inject arbitrary data...

Foscam C1 Indoor HD Camera Command Injection Vulnerability (CNVD-2017-14064)

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A security vulnerability exists in the web management interface in the Foscam C1 Indoor HD Camera using application firmware version 2.52.2.37. The vulnerability can be exploited to inject arbitrary shell characters by sendi...

Foscam C1 Indoor HD Camera cgiproxy.fcgi dns2 address configuration command injection vulnerability

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A security vulnerability exists in the web management interface in the Foscam C1 Indoor HD Camera using application firmware version 2.52.2.37. The vulnerability can be exploited to inject arbitrary shell characters by sendi...

CVE-2017-10796

On TP-Link NC250 devices with firmware through 1.2.1 build 170515, anyone can view video and audio without authentication via an rtsp://admin@yourip:554/h264hd.sdp URL...

CVE-2017-6030

A Predictable Value Range from Previous Values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The affected...

Improper Access Control Vulnerability in Toshiba Home gateway HEM-GW16A Firmware

TOSHIBA Home Gateway HEM-GW26A and TOSHIBA Home Gateway HEM-GW16A are both home gateway products from Toshiba Japan. An access control error vulnerability exists in the TOSHIBA Home Gateway HEM-GW26A using firmware version HEM-GW26A-FW-V1.2.0 and earlier and the TOSHIBA Home Gateway HEM-GW16A usi...

PT-2017-9770 · Foscam · Foscam C1

Name of the Vulnerable Software and Affected Versions: Foscam C1 version 1.9.1.12 Description: The issue concerns hard-coded FTP credentials, specifically r:r, included in the firmware. This could allow remote access to cameras connected to the internet without port 50021 blocked by an intermedia...

KDDI HOME SPOT CUBE WebUI Operating System Command Injection Vulnerability

KDDI HOME SPOT CUBE is a home wireless router product from KDDI Japan.WebUI is one of the graphical user interfaces. An operating system command injection vulnerability exists in the WebUI of the KDDI HOME SPOT CUBE2 using firmware version 101 and earlier. A remote attacker can exploit this...