Command injection

Command injection vulnerability in firmwarecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

Command injection

Command injection vulnerability in logincgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

Directory traversal

Directory traversal vulnerability in storagecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences...

CVE-2019-6275

GL-AR300M-Lite (firmware 2.27) is affected by CVE-2019-6275 due to a command injection vulnerability in the firmware_cgi component, enabling arbitrary code execution. Affected product: GL.iNet GL-AR300M-Lite; vulnerability source: CVE entry and corroborating exploit listings. Technical details ac...

CVE-2019-6275

Command injection vulnerability in firmwarecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

CVE-2019-6274

CVE-2019-6274 affects GL.iNet GL-AR300M-Lite devices with firmware 2.27, due to a directory traversal vulnerability in storage_cgi. The issue allows remote attackers to influence the system via directory traversal sequences (reported impact as unspecified in the CVE description), with exploit ref...

CVE-2019-6274

Directory traversal vulnerability in storagecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences...

CVE-2019-6273

CVE-2019-6273 affects GL.iNet GL-AR300M-Lite devices running firmware 2.27. Affected component: download_file handling in the device’s UI/ CGI flow. Root cause and exact code path are not detailed in the provided documents, but multiple sources describe an arbitrary file download vulnerability, w...

CVE-2019-6273

downloadfile in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files...

CVE-2019-6272

GL-AR300M-Lite devices (firmware 2.27) are affected by CVE-2019-6272 due to a vulnerability in login_cgi that enables authenticated command injection, potentially allowing arbitrary code execution. The issue is triggered after an attacker with prior login access sends crafted requests to login_cg...

CVE-2019-6272

Command injection vulnerability in logincgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

PT-2019-18064

Name of the Vulnerable Software and Affected Versions GL.iNet GL-AR300M-Lite version 2.27 Description A command injection issue in the login cgi of GL.iNet GL-AR300M-Lite devices allows remote attackers to execute arbitrary code. Recommendations For version 2.27, update the firmware to a version...

CVE-2019-6272: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in logincgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

PT-2019-18066

Name of the Vulnerable Software and Affected Versions GL.iNet GL-AR300M-Lite version 2.27 Description A directory traversal issue in the storage cgi of GL.iNet GL-AR300M-Lite devices allows remote attackers to have an unspecified impact via directory traversal sequences. Recommendations For versi...

PT-2019-18067

Name of the Vulnerable Software and Affected Versions GL.iNet GL-AR300M-Lite version 2.27 Description A command injection issue in the firmware cgi of GL.iNet GL-AR300M-Lite devices allows remote attackers to execute arbitrary code. Recommendations For version 2.27, at the moment, there is no...

PT-2019-18065

Name of the Vulnerable Software and Affected Versions GL.iNet GL-AR300M-Lite version 2.27 Description The issue allows remote attackers to download arbitrary files due to the download file in the firmware. Recommendations For version 2.27, update to a newer version that contains a fix for this...

CVE-2019-6274: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in storagecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences...

CVE-2019-6275: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in firmwarecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

CVE-2019-6273: Improper Limitation of a Pathname to a Restricted Directory

downloadfile in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files...

Design/Logic Flaw

In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a "4.01...