PT-2021-7934 · Luci +1 · Luci +1

Name of the Vulnerable Software and Affected Versions: OpenWrt versions 18.06.0 through 18.06.4 Description: The issue is related to a stored XSS vulnerability in LuCI, a component of OpenWrt. This vulnerability can be exploited via a crafted SSID, potentially allowing a remote attacker to perfor...

Attackers Steal E-Mails, Info from OpenWrt Forum

The forum supporting the community for OpenWrt suffered a security breach over the weekend, giving hackers access to e-mail addresses, user handles and additional private forum user information. Those that maintain the forum for the Linux-based open-source firmware said the forum was breached in...

Security Advisory 2021-01-19-1 - dnsmasq multiple vulnerabilities (CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25684, CVE-2020-25685, CVE-2020-25686, CVE-2020-25687)

DESCRIPTION Dnsmasq has two sets of vulnerabilities, one set of memory corruption issues handling DNSSEC and a second set of issues validating DNS responses. These vulnerabilities could allow an attacker to corrupt memory on the target device and perform cache poisoning attacks against the target...

The vulnerability of the libuci library in the embedded operating system OpenWrt allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the libuci library in the embedded operating system OpenWrt relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Security Advisory 2021-01-17-1 - OpenWrt forum break-in on 16-Jan-2021

DESCRIPTION Around 0400 GMT on 16 Jan 2021, an administrator account on the OpenWrt forum https://forum.openwrt.org was breached. It is not known how the account was accessed: the account had a good password, but did not have two-factor authentication enabled. The intruder was able to download a...

Denial of Service Vulnerability in OpenWrt

OpenWRT is a highly modular, highly automated embedded Linux system with powerful networking components and extensibility that is often used in industrial control devices, telephones, small robots, smart homes, routers, and VOIP devices. A denial of service vulnerability exists in OpenWrt, which...

Security Advisory 2020-12-09-1 - Linux kernel - ICMP rate limiting can be used to facilitate DNS poisoning attack (CVE-2020-25705)

DESCRIPTION A flaw has been found in the ICMP rate limiting algorithm of the Linux kernel. This flaw allows an off-path attacker to quickly determine open ephemeral ports that are used by applications making outbound connections. This can be exploited by an off-path attacker to more easily perfor...

Security Advisory 2020-12-09-2 - libuci import heap use after free (CVE-2020-28951)

DESCRIPTION Possibly exploitable vulnerability was found in Unified Config Interface UCI library named libuci, specifically in uciimport C API function. CVE-2020-28951 has been assigned to this issue. API: Application Programming Interface REQUIREMENTS In order to exploit this vulnerability a...

OpenWrt Web UI Detection.

Binary data openwrtwebuidetect.nbin...

OpenWrt < 18.06.2 XSS (direct check)

Binary data openwrtcve201819630.nbin...

CVE-2020-28951

libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uciparsepackage in file.c and ucistrdup in util.c...

CVE-2020-28951

libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uciparsepackage in file.c and ucistrdup in util.c...

Double free

libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uciparsepackage in file.c and ucistrdup in util.c...

CVE-2020-28951

libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uciparsepackage in file.c and ucistrdup in util.c...

CVE-2020-28951

CVE-2020-28951 affects OpenWrt libuci. A use-after-free can occur in libuci when processing malicious package names, specifically in uci_parse_package (file.c) and uci_strdup (util.c). Affected OpenWrt versions: 18.06.0–18.06.8 and 19.07.0–19.07.4. Remediation is to upgrade to OpenWrt 18.06.9 or ...

OpenWrt Resource Management Error Vulnerability

OpenWrt is a Linux operating system for embedded devices. A security vulnerability exists in libuci in OpenWrt versions prior to 18.06.9 and 19.x series versions prior to 19.07.5, which stems from the possibility of encountering the use of a malware package name after using free. This is related ...

PT-2020-5336 · Openwrt · Openwrt +1

Name of the Vulnerable Software and Affected Versions: OpenWrt versions 18.06.0 through 18.06.8 OpenWrt versions 19.0.0 through 19.07.4 Description: The issue is related to a use after free error in the libuci library of OpenWrt. This error can occur when using malicious package names, specifical...

The vulnerability of the uhttpd function in the embedded operating system OpenWrt allows a hacker to trigger a service failure.

The vulnerability of the uhttpd function in the embedded operating system OpenWrt relates to the execution of operations outside the buffer boundaries. Exploiting this vulnerability allows a malicious actor to trigger a service failure by sending a specially crafted HTTP POST request to the CGI...

The vulnerability of the Ustream-SSL library in the embedded operating system OpenWrt allows a attacker to execute a type of attack known as “man-in-the-middle” attack.

The vulnerability of the Ustream-SSL library in the embedded operating system OpenWrt is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack...

The vulnerability of the Ustream-SSL library in the embedded operating system OpenWrt allows a attacker to execute a type of attack known as “man-in-the-middle” attack.

The vulnerability of the Ustream-SSL library in the embedded operating system OpenWrt is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack...