Buffer Overflow vulnerability in FreeBSD

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A vulnerability in FreeBSD ping has been discovered that could allow remote code execution. A remote host can trigger the memory safety bug, causing the ping program to crash. Ping runs inside a...

PT-2022-27541 · Tenda · Tenda W6-S

Name of the Vulnerable Software and Affected Versions: Tenda W6-S version 1.0.0.4510 Description: A command injection issue was found in the tpi get ping output function at the "/goform/exeCommand" API endpoint. Recommendations: For Tenda W6-S version 1.0.0.4510, consider disabling the tpi get pi...

Tenda W6 缓冲区错误漏洞

The Tenda W6 is a wireless WiFi AP access point router from Tenda, China. A security vulnerability exists in Tenda W6-S v1.0.0.4510, which is caused by a stack overflow in the linkEn parameter via /goform/setAutoPing...

FreeBSD : FreeBSD -- ping stack buffer overflow (FreeBSD-SA-22:15.ping)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FreeBSD-SA-22:15.ping advisory. - ping contains a stack buffer overflow in the handling of incoming ICMP packets. A remote attacker can send specially...

Critical Ping Vulnerability Allows Remote Attackers to Take Over FreeBSD Systems

The maintainers of the FreeBSD operating system have released updates to remediate a security vulnerability impacting the ping module that could be potentially exploited to crash the program or trigger remote code execution. The issue, assigned the identifier CVE-2022-23093, impacts all supported...

The vulnerability of the pr_pack() function in the ping utility of the FreeBSD operating system allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the prpack function in the ping utility of the FreeBSD operating system arises from buffer overflows in the stack during the processing of ICMP messages. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root privileges...

FreeBSD 安全漏洞

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD. An attacker exploiting this vulnerability could trigger a denial of service and possibly run code by triggering a FreeBSD buffer overflow via ping...

PT-2022-5681 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD versions prior to 13.1-RELEASE-p5 FreeBSD versions prior to 12.4-RC2-p2 FreeBSD versions prior to 12.3-RELEASE-p10 Description: The issue is related to the ping utility in FreeBSD, which reads raw IP packets from the network to proces...

FreeBSD-SA-22:15.ping

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-22:15.ping Security Advisory The FreeBSD Project Topic: Stack overflow in ping8 Category: core Module: ping Announced: 2022-11-29 Credits: NetApp, Inc. Affects:...

FreeBSD -- Stack overflow in ping(8)

Problem Description: ping reads raw IP packets from the network to process responses in the prpack function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an ICMP error. The quot...

VulnCheck KEV: CVE-2022-37661

SmartRG SR506n 2.5.15 and SR510n 2.6.13 routers are vulnerable to Remote Code Execution RCE via the ping host feature...

CVE-2020-23583

OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diagpingadmin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system...

Optilink Network OP-XT71000N 命令注入漏洞

The Optilink Network OP-XT71000N is a wireless router from Optilink Network India. The Optilink Network OP-XT71000N version V2.2 suffers from a command injection vulnerability that can be exploited remotely when an attacker sends arbitrary code that results in a COMMAND EXECUTION to the "PingTest...

PT-2022-8676 · Optilink · Optilink Op-Xt71000N

Name of the Vulnerable Software and Affected Versions: OPTILINK OP-XT71000N version 2.2 Description: The issue is related to Remote Code Execution. It occurs when an attacker sends arbitrary code to the "/diag ping admin.asp" API endpoint, specifically to the "PingTest" interface, leading to...

PT-2022-8677 · Optilink · Optilink Op-Xt71000N

Name of the Vulnerable Software and Affected Versions: OPTILINK OP-XT71000N version V2.2 Description: The issue occurs due to unauthenticated remote code execution when an attacker passes arbitrary commands with an IP-ADDRESS using " | " to execute commands on "/diag tracert admin.asp" in the...

CVE-2022-36784 Elsight – Elsight Halo Remote Code Execution (RCE)

Elsight – Elsight Halo Remote Code Execution RCE Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics/wifi/wlan0/ping we can abuse DESTINATION parameter and leverage it to remote code execution...

Elsight Halo 安全漏洞

Elsight Halo is the drone operations management of Elsight, Inc. Elsight Halo suffers from a security vulnerability that stems from the fact that accessing the /api/v1/nics/wifi/wlan0/ping page via a POST request can be used to remotely execute code using the DESTINATION parameter...

PT-2022-23623 · Elfsight · Elsight Halo

Name of the Vulnerable Software and Affected Versions: Elsight Halo affected versions not specified Description: The Elsight Halo web panel allows connection validation through a POST request to /api/v1/nics/wifi/wlan0/ping, which can be exploited by abusing the DESTINATION parameter to achieve...

Researchers Say China State-backed Hackers Breached a Digital Certificate Authority

A suspected Chinese state-sponsored actor breached a digital certificate authority as well as government and defense agencies located in different countries in Asia as part of an ongoing campaign since at least March 2022. Symantec, by Broadcom Software, linked the attacks to an adversarial group...

Zoho ManageEngine Command Injection (CVE-2021-43319)

A command injection vulnerability exists in ManageEngine Network Configuration Manager. This vulnerability is due to insufficient validation in the ipaddress field of the ping functionality in add device web interface...