CVE-2016-5638

There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.401.0.6877. Genie app adds some capabilities over the Web GUI and can be accessed even when you are away from home. A remote attacker can access genieping.htm or genieping2.htm or...

Authentication flaw

There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.401.0.6877. Genie app adds some capabilities over the Web GUI and can be accessed even when you are away from home. A remote attacker can access genieping.htm or genieping2.htm or...

CVE-2016-5638 Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877 reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear text

There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.401.0.6877. Genie app adds some capabilities over the Web GUI and can be accessed even when you are away from home. A remote attacker can access genieping.htm or genieping2.htm or...

CVE-2016-5638: Cleartext Transmission of Sensitive Information

There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.401.0.6877. Genie app adds some capabilities over the Web GUI and can be accessed even when you are away from home. A remote attacker can access genieping.htm or genieping2.htm or...

broadbandgenie.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-597831 Description| Value ---|--- Affected Website:| broadbandgenie.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Linksys WVBR0-25 User-Agent Command Execution Exploit

The Linksys WVBR0-25 Wireless Video Bridge, used by DirecTV to connect wireless Genie cable boxes to the Genie DVR, is vulnerable to OS command injection in versions prior to 1.0.41 of the web management portal via the User-Agent header. Authentication is not required to exploit this vulnerabilit...

Linksys WVBR0-25 User-Agent Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Linksys WVBR0-25 User-Agent Command Execution', 'Description' = %q The Linksys WVBR0-25 Wireless Video Bridge, used by DirecTV to connect wireless...

Linksys WVBR0-25 - User-Agent Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Linksys WVBR0-25 User-Agent Command Execution', 'Description' = %q The Linksys WVBR0-25 Wireless Video Bridge, used by DirecTV to connect wireless...

Linksys WVBR0 25 Command Injection(CVE-2017-17411)

In this guest blog, Trend Micro DVLabs researcher Ricky Lawshae discusses the recently disclosed CVE-2017-17411. He discovered and reported this bug through the ZDI program. Earlier this year, I learned that AT&T was starting to move customers away from its U-Verse service in favor of its DirecTV...

Zero-Day Remote 'Root' Exploit Disclosed In AT&T DirecTV WVB Devices

Security researchers have publicly disclosed an unpatched zero-day vulnerability in the firmware of AT&T DirecTV WVB kit after trying to get the device manufacturer to patch this easy-to-exploit flaw over the past few months. The problem is with a core component of the Genie DVR system that's...

Linksys WVBR0-25 User-Agent Command Execution

The Linksys WVBR0-25 Wireless Video Bridge, used by DirecTV to connect wireless Genie cable boxes to the Genie DVR, is vulnerable to OS command injection in version use exploit/linux/http/linksys/wvbr0useragentexecnoauth msf undefinedwvbr0useragentexecnoauth show actions ...actions... msf...

Young Genie - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Young Genie published at the 'play' market has multiple vulnerabilities...

NETGEAR Genie - Exported components, External URLs, GPL license vulnerabilities

HackApp vulnerability scanner discovered that application NETGEAR Genie published at the 'play' market has multiple vulnerabilities...

Fortitude HTTP 1.0.4.0 Privilege Escalation

Exploit Title: Fortitude HTTP 1.0.4.0 Unquoted Service Path Elevation of Privilege Date: 05/10/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Author twitter: @tulpasecurity Vendor Homepage: http://www.networkdls.com/ Software Link:...

Fortitude HTTP 1.0.4.0 - Unquoted Service Path Privilege Escalation

Exploit for windows platform in category local exploits Exploit Title: Fortitude HTTP 1.0.4.0 Unquoted Service Path Elevation of Privilege Date: 05/10/2016 Exploit Author: Tulpa Contact: email protected Author website: www.tulpa-security.com Author twitter: @tulpasecurity Vendor Homepage:...

Fortitude HTTP 1.0.4.0 - Unquoted Service Path Privilege Escalation

Exploit Title: Fortitude HTTP 1.0.4.0 Unquoted Service Path Elevation of Privilege Date: 05/10/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Author twitter: @tulpasecurity Vendor Homepage: http://www.networkdls.com/ Software Link:...

Fortitude HTTP 1.0.4.0 - Unquoted Service Path Privilege Escalation

Fortitude HTTP 1.0.4.0 - Unquoted Service Path Privilege Escalation Exploit Title: Fortitude HTTP 1.0.4.0 Unquoted Service Path Elevation of Privilege Date: 05/10/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Author twitter: @tulpasecurity...

Netgear Genie 2.4.32 - Unquoted Service Path Elevation of Privilege Vulnerability

Exploit for windows platform in category local exploits Exploit Title: Netgear Genie 2.4.32 Unquoted Service Path Elevation of Privilege Date: 30/09/2016 Exploit Author: Tulpa Contact: email protected Author website: www.tulpa-security.com Vendor Homepage: www.netgear.com Software Link:...

NETGEAR Genie 2.4.32 - Unquoted Service Path Privilege Escalation

NETGEAR Genie 2.4.32 - Unquoted Service Path Privilege Escalation Exploit Title: Netgear Genie 2.4.32 Unquoted Service Path Elevation of Privilege Date: 30/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: www.netgear.com...

Netgear Genie 2.4.32 - Unquoted Service Path Privilege Escalation

Exploit Title: Netgear Genie 2.4.32 Unquoted Service Path Elevation of Privilege Date: 30/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: www.netgear.com Software Link: https://www.netgear.com/home/discover/apps/genie.aspx?...