The vulnerability in the web interface of the LuCI configuration interface in the embedded operating system OpenWrt allows a hacker to manipulate inter-site requests.

The vulnerability of the LuCI configuration web interface in the embedded operating system OpenWrt exists due to the improper functioning of the mechanism for protecting the web page structure. Exploiting this vulnerability allows a malicious actor to manipulate inter-site requests using certain...

The vulnerability of the umdns function in the embedded operating system OpenWrt allows a hacker to trigger buffer overflows.

The vulnerability of the umdns function in the embedded operating system OpenWrt relates to reading data beyond the buffer limit. Exploiting this vulnerability can allow a remote attacker to trigger a buffer overflow...

The vulnerability of the relayd function in the embedded operating system OpenWrt allows a hacker to trigger buffer overflows.

The vulnerability of the relayd function in the embedded operating system OpenWrt relates to reading data beyond the buffer limit. Exploiting this vulnerability can allow a remote attacker to cause a buffer overflow...

Security Advisory 2020-05-06-1 - umdns out-of-bounds reads of heap data and possible buffer overflow (CVE-2020-11750)

DESCRIPTION umdns in OpenWrt through 18.06.8 and 19.07.2 has potential for out-of-bounds reads of heap data and possible buffer overflow. umdns is the OpenWrt Multicast DNS Daemon. We have not been made aware of any exploits at this time, however users are advised to update the umdns package to...

Security Advisory 2020-05-06-2 - relayd out-of-bounds reads of heap data and possible buffer overflow (CVE-2020-11752)

DESCRIPTION relayd in OpenWrt through 19.07.2 and 18.06.8 has potential for out-of-bounds reads of heap data and possible buffer overflow. relayd is a transparent routing / relay daemon for OpenWrt. It can be used to relay traffic between two networks, including DHCP and broadcast, when other...

The vulnerability of the libubox library in the embedded operating system OpenWrt, which allows a hacker to execute arbitrary code.

The vulnerability of the libubox library in the embedded operating system OpenWrt relates to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2020-11967

In IQrouter through 3.3.1, remote attackers can control the device restart network, reboot, upgrade, reset because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

CVE-2020-11967

In IQrouter through 3.3.1, remote attackers can control the device restart network, reboot, upgrade, reset because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

CVE-2020-11968

In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step for settin...

CVE-2020-11966

In IQrouter through 3.3.1, the Lua function resetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

CVE-2020-11964

In IQrouter through 3.3.1, the Lua function diagsetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

CVE-2020-11963

IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configurati...

CVE-2020-11963

IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configurati...

CVE-2020-11965

In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step fo...

CVE-2020-11966

In IQrouter through 3.3.1, the Lua function resetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

Remote code execution

IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configurati...

Design/Logic Flaw

In IQrouter through 3.3.1, the Lua function resetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

Design/Logic Flaw

In IQrouter through 3.3.1, remote attackers can control the device restart network, reboot, upgrade, reset because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

Design/Logic Flaw

In IQrouter through 3.3.1, the Lua function diagsetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

Design/Logic Flaw

In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step for settin...