CVE-2021-20139

An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to...

CVE-2021-20139

The CVE-2021-20139 entry concerns Gryphon Tower routers, where an unauthenticated command injection affects the controller_server service (operation 3). A remote attacker on the same network can send a crafted packet to the controller_server on port 9999 to execute commands as root on the device....

CVE-2021-20138

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to th...

CVE-2021-20138

The CVE-2021-20138 entry concerns a command injection vulnerability in the Gryphon Tower router web interface (/cgi-bin/luci/rc). According to the provided documents, an unauthenticated attacker on the same network can send a crafted packet to the web interface and execute commands as root on the...

CVE-2021-20137

Gryphon Tower router web interface is affected by a reflected XSS in the URL parameter of /cgi-bin/luci/site_access/. An attacker can lure a user to a crafted link, causing JavaScript execution in the victim’s browser. The connected nuclei template confirms the impact; remediation is to upgrade t...

CVE-2021-20137

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/siteaccess/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution...

CVE-2021-20142

An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20142

The CVE-2021-20142 entry describes an unauthenticated command injection in Gryphon Tower routers. Affected component: controller_server service (operation 41). Root cause: inadequate input filtering of parameters, allowing crafted packets to inject commands. Attack path: remote attacker on the sa...

CVE-2021-20141

An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20141

CVE-2021-20141 concerns Gryphon Tower routers. Several sources describe an unauthenticated command-injection vulnerability in the controller_server service, specifically in operation 32, where a remote attacker on the same network can send crafted packets to port 9999 and execute commands as root...

CVE-2021-20140

An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20140

Summary: CVE-2021-20140 describes an unauthenticated command injection in Gryphon Tower routers. The vulnerability occurs in the controller_server service, specifically in operation 10, where a crafted packet sent to port 9999 from an on-network attacker can execute commands as root. Multiple con...

CVE-2021-20146

An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon's development and infrastructure. At the time of discovery, the ssh key could be used to login to the development server hosted in Amazon Web Services...

CVE-2021-20146

CVE-2021-20146 describes an information disclosure/privilege escalation on Gryphon Tower devices due to an unprotected SSH private key, enabling potential root access to a Gryphon development server hosted on AWS. Affected component is the device’s SSH key handling; root access to connected infra...

CVE-2021-20145

Gryphon Tower routers are affected by CVE-2021-20145 due to an unprotected OpenVPN configuration file. The root cause is configuration data left accessible, which can grant an attacker access to the Gryphon homebound VPN network and expose LAN interfaces of other users’ devices sharing the same s...

CVE-2021-20145

Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the LAN interfaces of other users' devices connected to the same service. An attacker could leverage this to make configuration changes to, o...

CVE-2021-20144

An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20144

CVE-2021-2014*4 : Toshiba? Wait. Sorry. I must provide the actual content.

CVE-2021-20143

An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20143

The CVE-2021-20143 entry concerns Gryphon Tower routers. Affected component: controller_server service; vulnerability in operation 48 parameters allowing unauthenticated remote attackers on the same network to run commands as root by sending a crafted packet to port 9999. Documents consistently d...