40 matches found
CVE-2021-46704
Inyección de comandos del sistema operativo en GenieACS CVE-2021-46704 Plantilla de Nuclei para CVE-2021-46704 Referencia : https://github.com/advisories/GHSA-2877-693q-pj33 https://nvd.nist.gov/vuln/detail/CVE-2021-46704 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-46704...
CVE-2021-46704-POC
CVE-2021-46704-POC CVE-2021-46704 GenieACS PoC de Inyección de Comandos Afecta al paquete genieacs, versiones =1.2.0 1.2.8 ¿Cómo solucionarlo? Actualice genieacs a la versión 1.2.8 o superior. Las versiones afectadas de este paquete son vulnerables a Inyección de Comandos a través del argumento...
GenieACS => 1.2.8 - OS Command Injection
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check. id: CVE-2021-46704 info:...
CVE-2025-56015
CVE-2025-56015 GenieACS RCE Übersicht Proof-of-Concept-Exploit für CVE-2025-56015 , eine kritische Sandbox-Escaping- und Code-Injection-Schwachstelle in GenieACS , die die Ausführung beliebigen JavaScript-Codes im Provisioning-Kontext ermöglicht. Durch Ausnutzung der...
CVE-2026-55637
creationtimestamp| type| source ---|---|--- 2026-08-25 20:35:33+00:00| published-proof-of-concept| https://github.com/GeiserX/genieacs-mcp/security/advisories/GHSA-cmwv-wf9p-p8wx 2026-08-26 12:32:44+00:00| seen| https://gist.github.com/alon710/f1f1abcaa50d05cc95fe39660771a422...
CVE-2026-55637
genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...
GHSA-CMWV-WF9P-P8WX genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport
genieacs-mcp exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled Host and Origin headers. A malicious web page can use DNS rebinding to route browser requests to a victim's loopback MCP listener while preserving the attacker origin. The server accepts the request,...
CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport
genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...
CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport
genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...
EUVD-2026-65692
genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...
CVE-2026-55637
genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2 , the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default address 127.0.0.1:8080 when MCP_AUTH_TOKEN is unset, without validating Host or Origin headers. A malicious websit...
PT-2026-81459
Name of the Vulnerable Software and Affected Versions genieacs-mcp versions prior to 0.3.2 Description The Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp endpoint on the default address 127.0.0.1:8080 when the MCP AUTH TOKEN variable is unset. The server fails to...
CVE-2025-56015
In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint...
GHSA-2H6J-MHCP-9J9H GenieACS has an unauthenticated access vulnerability via the NBI API endpoint
In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint...
GenieACS has an unauthenticated access vulnerability via the NBI API endpoint
In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint...
EUVD-2025-209276
In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint...
CVE-2025-56015
In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint...
Access Control Bypass
Overview genieacs is an A TR-069 Auto Configuration Server ACS Affected versions of this package are vulnerable to Access Control Bypass via the NBI API endpoint. An attacker can gain unauthorized access to sensitive functionality or data by sending unauthenticated requests. Remediation There is ...
