CVE-2016-8276

Buffer overflow in the Point-to-Point Protocol over Ethernet PPPoE module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600, when CHAP authentication is configured on the server, allows remote attackers to cause a denial of service...

Code injection

Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote attackers to cause a denial of service device restart via an unspecified URL...

Command injection

Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote authenticated users to cause a denial of service device restart via an unspecified command parameter...

CVE-2016-8278

The CVE-2016-8278 entry affects Huawei USG9520/9560/9580 devices running software before V300R001C01SPCa00, where a remote attacker could trigger a DoS leading to a device restart via an unauthenticated, unspecified URL. Public references in the provided documents corroborate the affected models ...

CVE-2016-8277

CVE-2016-8277 affects Huawei USG9520, USG9560 and USG9580 devices running software prior to V300R001C01SPCa00. A remote authenticated attacker can trigger a denial-of-service (device restart) by sending a malicious parameter in an unspecified command. Multiple sources corroborate that Huawei rele...

CVE-2016-8278

Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote attackers to cause a denial of service device restart via an unspecified URL...

CVE-2016-6669

Buffer overflow in the Authentication, Authorization and Accounting AAA module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600 allows remote authenticated RADIUS servers to execute arbitrary code by sending a crafted EAP packet...

Cross-Site Scripting Vulnerability in Multiple Moxa Products

Moxa OnCell G3100 and others are IP gateway products from Moxa. A cross-site scripting vulnerability exists in multiple Moxa products, which can be exploited by an attacker to execute arbitrary script code in a user's browser...

SQL Injection Vulnerability in hid_id and oldpwd Parameters of Multiple Series of D-Link Behavioral Gateways

D-Link DAR-8000-X series and DAR-7000-x series Internet Access Behavior Audit Gateways provide Internet access behavior management solutions. A SQL injection vulnerability exists in several series of D-Link behavior gateways. The file in question is autheditepwd.php, and the injection parameters...

Number of Devices Sharing Private Crypto Keys Up Sharply

Researchers at SEC Consult say the number of internet gateways, routers, modems and other embedded devices sharing cryptographic keys and certificates is up 40 percent since the Austrian consulting firm first looked at the problem in November. The report, posted Tuesday called “House of Keys,”...

Network-based DNS logging in Go: GoPassiveDNS

A network-capture based DNS logger, inspired by passivedns. It uses gopacket to deal with libpcap and packet processing. It outputs JSON logs. It is intended to deal with high volume query capture in environments with anywhewre from one to hundreds of DNS resolvers. Why not use PassiveDNS from...

Authentication Bypass Vulnerability in Multiple Moxa Products

Moxa MGate MB3180 and others are gateway products from Moxa. A security vulnerability exists in a number of Moxa products that stems from the program's use of weak encryption algorithms. A remote attacker could exploit this vulnerability by performing a brute force exploit to bypass authenticatio...

500K Members of Hacking Forum Doxxed

An underground forum called Nulled.io that helped users share stolen credentials, software cracks, and leaked content was hacked earlier this month, spilling a glut of information, including users’ email addresses, encrypted passwords, and IP addresses, among other details. According to researche...

Advantech EKI Vulnerable to Bypass, Possible Backdoor

Researchers have uncovered yet another issue–and potential backdoor–in Advantech’s beleaguered EKI-1322 serial device server. The Dropbear SSH daemon associated with the server, because of heavy modifications, fails to enforce authentication. This makes it so any user who wants to bypass...

How do I Customize Unified Gateway Portal?

Use Case Portal is the first interaction point for end users and hence important to have correct representation of an organization. Customize the look and feel, color, logo and labels on the Gateway portal to brand the portal as per organizational standards. Introduction to Portal Customization...

Cisco Warning of CSRF, XSS Vulnerabilities

UPDATE Cisco is warning users this week that several of its products — routers, gateways, and data center platforms — suffer from vulnerabilities, including one critical one. Cisco warned about the most pressing issue, a critical vulnerability in its Prime Collaboration Assurance software, shortl...

CVE-2015-8084

Huawei USG5500, USG2100, USG2200, and USG5100 unified security gateways with software before V300R001C10SPC600, when "DHCP Snooping" is enabled and either "option82 insert" or "option82 rebuild" is enabled on an interface, allow remote attackers to cause a denial of service reboot via crafted DHC...

CVE-2015-8084

Huawei USG5500, USG2100, USG2200, and USG5100 unified security gateways with software before V300R001C10SPC600, when "DHCP Snooping" is enabled and either "option82 insert" or "option82 rebuild" is enabled on an interface, allow remote attackers to cause a denial of service reboot via crafted DHC...

CVE-2015-8083

An unspecified module in Huawei eSpace U1910, U1911, U1930, U1960, U1980, and U1981 unified gateways with software before V200R003C00SPC300 does not properly initialize memory when processing timeout messages, which allows remote attackers to cause a denial of service out-of-bounds memory access...

CVE-2015-7845

The CVE-2015-7845 in Huawei eSpace U1910/U1911/U1930/U1960/U1980/U1981 (pre‑V100R001C20SPH605) is caused by a flaw in the CLI Module’s exception handling that lets remote attackers trigger a denial of service (CLI outage) by sending specially crafted SSH packets. Affected devices are Huawei eSpac...