CVE-2020-5783: Cross-Site Request Forgery (CSRF)

In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms...

CVE-2020-5781: Improper Neutralization of Input During Web Page Generation

In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file /etc/config/luci by the authenticator.htmlauth function. When modified with arbitrary javascript, this causes a denial-of-service condition for all other users...

PT-2020-18702

Name of the Vulnerable Software and Affected Versions IgniteNet HeliOS GLinq version 2.2.1 r2961 Description The issue arises from the storage of the langSelection parameter in the luci configuration file /etc/config/luci by the authenticator.htmlauth function. This can be modified with arbitrary...

PT-2020-18704

Name of the Vulnerable Software and Affected Versions IgniteNet HeliOS GLinq version 2.2.1 r2961 Description The login functionality in the affected software lacks CSRF protection mechanisms, which could potentially allow for unauthorized actions. Recommendations For version 2.2.1 r2961, consider...

CVE-2020-5782: Undefined Security Weakness

In IgniteNet HeliOS GLinq v2.2.1 r2961, if a user logs in and sets the ‘wantype’ parameter, the wan interface for the device will become unreachable, which results in a denial of service condition for devices dependent on this connection...

PT-2020-18703

Name of the Vulnerable Software and Affected Versions IgniteNet HeliOS GLinq version 2.2.1 r2961 Description The issue occurs when a user logs in and sets the wan type parameter, causing the wan interface to become unreachable. This results in a denial of service condition for devices that depend...