3669 matches found
PT-2020-12471
Name of the Vulnerable Software and Affected Versions Tenda AC15 AC1900 version 15.03.05.19 Description A CSRF issue allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page, specifically targeting the "goform/SysToolReboot"...
CVE-2020-10989: Improper Neutralization of Input During Web Page Generation
An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter...
Buffer overflow vulnerability in multiple Tenda products (CNVD-2020-31408)
The Tenda AC9, among others, is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in httpd in several Tenda products. The vulnerability can be exploited to execute arbitrary code by sending the 'deviceId' and 'time' parameters to the...
Buffer overflow vulnerability in multiple Tenda products (CNVD-2020-31387)
The Tenda AC9, among others, is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in httpd in multiple Tenda products. The vulnerability can be exploited to execute arbitrary code by sending the 'entrys' and 'mitInterface' parameters to the /goform/addressNa...
Buffer overflow vulnerability in multiple Tenda products (CNVD-2020-31386)
The Tenda AC9, among others, is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in httpd in multiple Tenda products. The vulnerability can be exploited to execute arbitrary code by sending the 'schedStartTime' and 'schedEndTime' parameters to the...
CVE-2020-13390: Buffer Copy without Checking Size of Input
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19multiTD01, AC9 V1.0 V15.03.05.196318CN, AC9 V3.0 V15.03.06.42multi, AC15 V1.0 V15.03.05.19multiTD01, and AC18 V15.03.05.196318CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the...
CVE-2019-13395
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify all settings including WEP/WPA/WPA2 keys, restore the router to factory settings, or even upload an entire malicious configuration file...
PT-2020-9400
Name of the Vulnerable Software and Affected Versions: NETGEAR CG3700b custom firmware version V2.02.03 Description: The issue allows for Cross-Site Request Forgery CSRF attacks against all "/goform/" URIs. An attacker can modify all settings, including WEP/WPA/WPA2 keys, restore the router to...
PT-2020-6557
Name of the Vulnerable Software and Affected Versions Sumavision Enhanced Multimedia Router EMR version 3.0.4.27 Description The issue allows creation of arbitrary users with elevated privileges, specifically as administrators, on a device. This can be achieved through a request such as...
PT-2020-19935
Name of the Vulnerable Software and Affected Versions SMC Networks D3G0804W D3GNV5M version 3.5.1.6.10 GA Description The issue allows remote command execution by leveraging access to the Network Diagnostic Tools screen, as demonstrated by an admin login. The attacker must use a Parameter Polluti...
CVE-2020-8087: Improper Input Validation
SMC Networks D3G0804W D3GNV5M-3.5.1.6.10GA devices allow remote command execution by leveraging access to the Network Diagnostic Tools screen, as demonstrated by an admin login. The attacker must use a Parameter Pollution approach against goform/formSetDiagnosticToolsFmPing by providing the...
CVE-2019-19516
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=systempassword.asp to the goform/SysToolChangePwd URI to change a password...
CVE-2019-19516
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=systempassword.asp to the goform/SysToolChangePwd URI to change a password...
PT-2019-15863 · Intelbras · Intelbras Wrn 150
Name of the Vulnerable Software and Affected Versions: Intelbras WRN 150 version 1.0.18 Description: The issue allows for cross-site request forgery CSRF attacks, which can be used to change a password. This can be achieved by accessing the goform/SysToolChangePwd URI with GO=system password.asp...
CVE-2019-19516: Cross-Site Request Forgery (CSRF)
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=systempassword.asp to the goform/SysToolChangePwd URI to change a password...
PT-2019-17453
Name of the Vulnerable Software and Affected Versions Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route version AC9V1.0 Firmware V15.03.05.16multiTRU Description A command injection issue exists in the /goform/WanParameterSetting functionality. This can be triggered by a specially crafte...
PT-2019-17454
Name of the Vulnerable Software and Affected Versions Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route version AC9V1.0 Firmware V15.03.05.16multiTRU Description An exploitable command injection issue exists in the /goform/WanParameterSetting functionality. A specially crafted HTTP POST...
Tenda N301 Input Validation Error Vulnerability
The Tenda N301 is a wireless router from the Chinese company Tenda. An input validation error vulnerability exists in the Tenda N301. An attacker can exploit this vulnerability by sending the 'wifiSSID' parameter with a long string to goform/setWifi, causing the application to crash...
PT-2019-14735
Name of the Vulnerable Software and Affected Versions Embedthis GoAhead version 2.5.0 Description An issue was discovered where certain pages, such as "goform/login" and "config/log off page.htm", create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker...
