GoAhead Web Server 5.1.1 - Digest Authentication Capture Replay Nonce Reuse

Exploit Title: GoAhead Web Server 5.1.1 - Digest Authentication Capture Replay Nonce Reuse Date: 2019-08-29 Exploit Author: LiquidWorm Software Link: https://www.embedthis.com Version: 5.1.1 !/usr/bin/env python3 -- coding: utf-8 -- EmbedThis GoAhead Web Server 5.1.1 Digest Authentication Capture...

EmbedThis GoAhead Web Server 5.1.1 Digest Authentication Capture Replay Nonce Reuse

!/usr/bin/env python3 -- coding: utf-8 -- EmbedThis GoAhead Web Server 5.1.1 Digest Authentication Capture Replay Nonce Reuse Vendor: Embedthis Software LLC Product web page: https://www.embedthis.com Affected version: =5.1.2 and =4.1.3 Summary: GoAhead is the world's most popular, tiny embedded...

EmbedThis GoAhead Web Server 5.1.1 Digest Authentication Capture Replay Nonce Reuse

Summary GoAhead is the world's most popular, tiny embedded web server. It is compact, secure and simple to use. GoAhead is deployed in hundreds of millions of devices and is ideal for the smallest of embedded devices. Description A security vulnerability affecting GoAhead versions 2 to 5 has been...

ZTE Mobile Hotspot MS910S Backdoor / Hardcoded Password

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: ZTE mobile Hotspot MS910S vulnerable version: DLMF910SCNEUV1.00.01 fixed version: - CVE number: CVE-2019-3422 impact: High homepage:...

GoAhead Command Injection (CVE-2019-15311; CVE-2019-15310; CVE-2019-15312)

A command injection vulnerability exists in GoAhead. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary commands on the affected system...

Embedthis Software GoAhead Request Replay Attack Vulnerability

Embedthis Software GoAhead is an embedded Web server from Embedthis Software, USA. A request replay attack vulnerability exists in Embedthis Software GoAhead versions prior to 5.1.2, which stems from GoAhead's failure to properly handle nonce values during Digest authentication, and can be...

CVE-2020-15688

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel...

CVE-2020-15688

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel...

Authentication flaw

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel...

CVE-2020-15688

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel...

CVE-2020-15688

Vulnerability context: GoAhead Web Server before 5.1.2 is susceptible to a Digest authentication replay attack. An unauthenticated remote attacker can bypass authentication via capture-replay if TLS is not protecting the channel. The issue is tied to the Digest authentication implementation, not ...

PT-2020-14585 · Goahead · Goahead Web Server

Name of the Vulnerable Software and Affected Versions: GoAhead web server versions prior to 5.1.2 Description: The issue concerns the HTTP Digest Authentication in the GoAhead web server, which does not fully protect against replay attacks. This allows an unauthenticated remote attacker to bypass...

CVE-2019-15311

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command...

CVE-2019-15311

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command...

CVE-2019-15311

CVE-2019-15311 affects Zolo Halo devices via the Linkplay firmware. The vulnerability resides in the GoAhead web server running on port 80, with the /httpapi.asp endpoint exposing multiple command-execution flaws that enable LAN remote code execution. Multiple connected sources corroborate a GoAh...

Entropy Toolkit - A Set Of Tools To Exploit Netwave And GoAhead IP Webcams

Entropy Toolkit is a set of tools to exploit Netwave and GoAhead IP Webcams. Entropy is a powerful toolkit for webcams penetration testing. Getting started Entropy installation cd entropy chmod +x install.sh ./install.sh Entropy uninstallation cd entropy chmod +x uninstall.sh ./uninstall.sh Entro...

Exploit for Use After Free in Embedthis Goahead

CVE-2019-5096: Use After Free DoS Exploit python TriggerD...

Embedthis Goahead Use-After-Free (CVE-2019-5096)

A use-after-free vulnerability exists in Embedthis Goahead. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Critical Flaw in GoAhead Web Server Could Affect Wide Range of IoT Devices

Cybersecurity researchers today uncovered details of two new vulnerabilities in the GoAhead web server software, a tiny application widely embedded in hundreds of millions of Internet-connected smart devices. One of the two vulnerabilities, assigned as CVE-2019-5096, is a critical code execution...

Critical Flaw in GoAhead Web Server Could Affect Wide Range of IoT Devices

Cybersecurity researchers today uncovered details of two new vulnerabilities in the GoAhead web server software, a tiny application widely embedded in hundreds of millions of Internet-connected smart devices. One of the two vulnerabilities, assigned as CVE-2019-5096, is a critical code execution...