CVE-2013-5037

The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers to obtain the WPA or WPA2 pre-shared key via EAP messages...

CVE-2013-5218

Cross-site scripting XSS vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject arbitrary web script or HTML via a crafted DHCP Host Name option, which is not properly handled during rendering of the DHCP table in wlanAccess.asp...

CVE-2013-5219

Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitrary files via a .. dot dot in a URI, as demonstrated by a request for /etc/passwd...

CVE-2013-5220

goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service device crash via crafted HTTP POST data...

CVE-2013-5037

The CVE-2013-5037 entry concerns the HOTBOX router (SAGEMCOM HOTBOX F@st 3184) running software version 2.1.11, where a default WPS PIN of 12345670 enables easier access to the WPA/WPA2 PSK via EAP messages. The connected sources corroborate the affected device and version and describe the underl...

CVE-2013-5039

The CVE-2013-5039 entry concerns the HOTBOX router (SAGEMCOM HOTBOX F@st 3184) with firmware 2.1.11. It describes a CSRF flaw in goform/wlanBasicSecurity that lets an attacker hijack administrator authentication to set WifiSecurity to Deactivated. Public material (e.g., exploit-db, packetstorm, 0...

CVE-2013-5219

CVE-2013-5219 affects HOTBOX Router/Modem (SAGEMCOM F@st 3184, 2.1.11). A directory traversal vulnerability allows an attacker to read arbitrary files via a .. in a URI (e.g., /etc/passwd). Evidence from multiple sources confirms the vulnerable component is the web-facing URI handling, enabling r...

CVE-2013-5218

CVE-2013-5218 describes an XSS vulnerability in the HOTBOX router (SAGEMCOM F@st 3184) with software 2.1.11. The issue arises from improper handling of a crafted DHCP Host Name option during rendering of the DHCP table in wlanAccess.asp, allowing remote attackers to inject arbitrary web script or...

CVE-2013-5220

The HOTBOX router (SAGEMCOM F@st 3184) is affected in version 2.1.11 by CVE-2013-5220, with documented issues including CSRF, traversal and denial of service via crafted HTTP POST to goform/login. Public sources (1337DAY, related advisories) specify multiple vulnerabilities in 2.1.11 and indicate...

PT-2013-5343

Name of the Vulnerable Software and Affected Versions HOT HOTBOX router version 2.1.11 Description The issue allows remote attackers to bypass authentication by configuring a source IP address that had previously been used for an authenticated session. Recommendations For version 2.1.11, consider...

PT-2013-5452

Name of the Vulnerable Software and Affected Versions HOT HOTBOX router version 2.1.11 Description A directory traversal issue allows remote attackers to read arbitrary files by including a .. dot dot in a URI. For example, a request for "/etc/passwd" can be used to exploit this issue...

PT-2013-5451

Name of the Vulnerable Software and Affected Versions HOT HOTBOX router version 2.1.11 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted DHCP Host Name option. This occurs because the DHCP table in wlanAccess.asp do...

PT-2013-5342

Name of the Vulnerable Software and Affected Versions HOT HOTBOX router version 2.1.11 Description The issue concerns a default WPS PIN that can be exploited by remote attackers to obtain the WPA or WPA2 pre-shared key via EAP messages, making it easier for them to gain unauthorized access...

PT-2013-5453

Name of the Vulnerable Software and Affected Versions HOTBOX router software version 2.1.11 Description The issue allows remote attackers to cause a denial of service, resulting in a device crash, by sending crafted HTTP POST data to the "goform/login" endpoint. Recommendations For software versi...

CVE-2013-5220: Improper Input Validation

goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service device crash via crafted HTTP POST data...

CVE-2013-5039: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.11 allows remote attackers to hijack the authentication of administrators for requests that change the WiFi Security field to Deactivated via the WifiSecurity parameter...

CVE-2013-5218: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject arbitrary web script or HTML via a crafted DHCP Host Name option, which is not properly handled during rendering of the DHCP table in wlanAccess.asp...

CVE-2013-5038: Improper Authentication

The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP address that had previously been used for an authenticated session...

CVE-2013-5219: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitrary files via a .. dot dot in a URI, as demonstrated by a request for /etc/passwd...

CVE-2013-5037: Undefined Security Weakness

The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers to obtain the WPA or WPA2 pre-shared key via EAP messages...