CVE-2019-20071: Cross-Site Request Forgery (CSRF)

On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs...

CVE-2019-20073: Improper Neutralization of Input During Web Page Generation

On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter User Account Configuration...

CVE-2019-20075: Improper Neutralization of Input During Web Page Generation

On Netis DL4323 devices, pingrttv6.html has XSS Ping6 Diagnostic...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

CVE-2019-20072: Improper Neutralization of Input During Web Page Generation

On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter Dynamic DNS Configuration...

CVE-2019-20076: Improper Neutralization of Input During Web Page Generation

On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter DynDns settings of the Dynamic DNS Configuration...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability (CNVD-2020-01650)

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

PT-2019-16077

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description The issue exists due to a problem with the hostname parameter in the "form2Ddns.cgi" script, which is part of the Dynamic DNS Configuration. This allows for XSS attacks. Recommendations...

PT-2019-16075

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description The issue exists due to a cross-site scripting XSS flaw. Specifically, the urlFQDN parameter in the form2url.cgi endpoint also known as the Keyword field of the URL Blocking Configuratio...

PT-2019-16079

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description The issue allows any user role to access sensitive information, including user passwords and the FTP password, by visiting the "form2saveConf.cgi" page. Recommendations For Netis DL4323...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability (CNVD-2020-01648)

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

CVE-2019-20074: Improper Privilege Management

On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page...

CVE-2019-20070: Improper Neutralization of Input During Web Page Generation

On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi aka the Keyword field of the URL Blocking Configuration...