CVE-2021-20143: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20140: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20139: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to...

Gryphon Tower 跨站脚本漏洞

A cross-site scripting vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from a lack of user-supplied data and output data validation filtering in the url parameter of cgi-bin/luci/siteaccess/, which can be exploited to execute client-side JavaScript...

CVE-2021-20138: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to th...

Gryphon Tower 操作系统命令注入漏洞

A command injection vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from the failure to properly filter the parameters of operation 41 in the controllerserver service on the router for special characters and commands entered by the user, which could ...

Gryphon Tower 操作系统命令注入漏洞

The Gryphon Tower is a wireless router from Gryphon. The Gryphon Tower suffers from a command injection vulnerability that originates from unauthenticated command injections in multiple parameters in the web interface of /cgi-bin/luci/rc, which can be exploited by an attacker to send a crafted...

Gryphon Tower 操作系统命令注入漏洞

A command injection vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from a failure to properly filter user input for special characters, commands, etc. in the parameters of operation 49 in the controllerserver service on the router. An unauthenticate...

CVE-2021-20142: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20141: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20144: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

Gryphon Tower 安全漏洞

Gryphon Tower is a wireless router from Gryphon, Inc. Gryphon Tower is vulnerable to an information disclosure vulnerability stemming from the presence of an unprotected ssh private key on the device, which could be exploited by an attacker to gain root access to servers belonging to Gryphon's...

CVE-2021-20146: Insufficiently Protected Credentials

An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon's development and infrastructure. At the time of discovery, the ssh key could be used to login to the development server hosted in Amazon Web Services...

Gryphon Tower 操作系统命令注入漏洞

The Gryphon Tower is a wireless router from Gryphon. A command injection vulnerability exists in Gryphon Tower, which originates from the failure of the parameters of operation 3 in the controllerserver service on the router to correctly filter special characters, commands, etc. entered by the...

Gryphon Tower 操作系统命令注入漏洞

Gryphon Tower is a wireless router from Gryphon, Inc. A command injection vulnerability exists in Gryphon Tower, which stems from the failure to properly filter user input for special characters, commands, etc. in the controllerserver service on the router, which could be exploited by a remote,...

Gryphon Tower 授权问题漏洞

Gryphon Tower is a wireless router from Gryphon, Inc. Gryphon Tower is vulnerable to an authorization issue that could be exploited by attackers to make configuration changes to the device...

CVE-2021-20145: Improper Authentication

Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the LAN interfaces of other users' devices connected to the same service. An attacker could leverage this to make configuration changes to, o...

CVE-2021-20137: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/siteaccess/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution...

Debian: Security Advisory (DLA-2547-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2021-1030 wireshark security update

Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer.\r\n\r\n Security Fixes:\r\n\r\n In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into ...