Generex CS141 CVE-2022-47191 - Privilege Escalation via Firmware Upload

Generex UPS CS141 below 2.06 accepts a crafted firmware archive with modified permissions, allowing a remote attacker to escalate privileges and execute commands as root. import shlex import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Generex CS141 CVE-2022-47190 - RCE via Firmware Upload

Generex UPS CS141 below 2.06 accepts a crafted firmware archive containing a webshell or equivalent command execution primitive, leading to remote code execution as root. import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import...

Generex NetMan 204 CVE-2022-47893 - RCE via Firmware Upload

Generex NetMan 204 accepts a crafted firmware file upload that enables remote code execution. This module uploads the operator-supplied firmware and dispatches a real framework payload to obtain a session. import time from kittysploit import from lib.protocols.http.httpclient import Httpclient fr...

Generex CS141 CVE-2022-47186 - Unrestricted File Upload/Delete

Generex UPS CS141 below 2.06 allows unauthenticated upload and deletion of arbitrary files inside the upload directory. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import CS141 class ModuleAuxiliary, Httpclient, CS141: info = "name":...

Generex CS141 CVE-2022-47187 - XSS via File Upload

Generex UPS CS141 below 2.06 allows unauthenticated upload of HTML content into the upload directory, enabling stored XSS when a victim opens the uploaded file. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import CS141 class...

Generex CS141 CVE-2022-47188 - Arbitrary Local File Read

Generex UPS CS141 below 2.06 allows a crafted backup archive containing a symlink to be restored, which can be abused to retrieve arbitrary local files from the device. from pathlib import Path import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Generex CS141 CVE-2022-47192 - Admin Password Reset via Backup Upload

Generex UPS CS141 below 2.06 allows a crafted backup archive with a modified users.json to be restored, replacing the administrator password hash. import json import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import CS141 class...

Generex NetMan 204 CVE-2022-47891 - Admin Password Reset

Generex NetMan 204 exposes enough device information to derive the recovery code and reset the administrator password to the default value. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.netman204 import NetMan204 class ModuleAuxiliary,...

Generex NetMan 204 CVE-2022-47892 - Sensitive Information Disclosure

Generex NetMan 204 exposes sensitive device information via netmandata.json, including MAC address and serial number which can be leveraged to derive the password recovery code. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.netman204 import...

Generex CS141 CVE-2022-47189 - DoS via Firmware Upload

Generex UPS CS141 below 2.06 accepts a crafted firmware archive that can disrupt the device functionality after the update process. import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import CS141 class ModuleAuxiliary, Httpclient...

CVE-2022-42457

Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches runupdate in /usr/bin/gxserve-update.sh e.g., command execution can occur via a reverse shell installed by install.sh...

Generex UPS Adapter CS141 Authenticated Remote Code Execution (CVE-2022-42457)

Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches runupdate in /usr/bin/gxserve-update.sh e.g., command execution can occur via a reverse shell installed by install.sh. This plugin only works with Tenable.ot. Please visit...

Generex UPS Adapter CS141 Improper Link Resolution Before File Access (CVE-2022-47188)

There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path. This plugin only works with Tenable.ot...

Generex UPS Adapter CS141 Unrestricted Upload of File with Dangerous Type (CVE-2022-47186)

There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the upload directory. This plugin only works with Tenable.ot. Please visit...

Generex UPS Adapter CS141 Improper Neutralization of Input During Web Page Generation (CVE-2022-47187)

There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file. This plugin only works with Tenable.ot...

Generex UPS Adapter CS141 Improper Input Validation (CVE-2022-47192)

Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified users.json to the web server of the device, allowing him to replace the administrator password. This plugin only works with Tenable.ot. Please visit...

Generex UPS Adapter CS141 Unrestricted Upload of File with Dangerous Type (CVE-2022-47191)

Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Generex UPS Adapter CS141 Unrestricted Upload of File with Dangerous Type (CVE-2022-47190)

Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Generex UPS Adapter CS141 Improper Input Validation (CVE-2022-47189)

Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more informatio...

Generex UPS Adapter CS141 Improper Limitation of a Pathname to a Restricted Directory (CVE-2020-11420)

UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerability by manipulating variables that reference files and by doing this achieve access to files and directories outside the web root folder. An attacker may acce...