CVE-2024-54807

In Netgear WNR854T 1.5.2 North America, the UPNP service is vulnerable to command injection in the function addmapexec which parses the NewInternalClient parameter of the AddPortMapping SOAPAction into a system call without sanitation. An attacker can send a specially crafted SOAPAction request f...

The vulnerability of the formSetPortMapping function in the Tenda G3 wireless access point’s microprogramming software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the formSetPortMapping function in the Tenda G3 wireless access point’s microprogramming software lies in the fact that the operation exceeds the buffer boundaries in memory when processing parameters such as pPortMapIndex, pLanIP, pProtocl, and pWanid. Exploiting this...

The vulnerability of the Port Forwarding technology in the microprogramming software for D-Link DSL-2750U allows a attacker to execute XSS attacks.

The vulnerability of the Port Forwarding technology of D-Link DSL-2750U software lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks via the PortMappingDescription parameter...

PT-2024-9600 · Tenda · Tenda G3

Name of the Vulnerable Software and Affected Versions: Tenda G3 version 3.0 v15.11.0.20 Description: The issue is related to a stack overflow in the formSetPortMapping function, which can be exploited to execute arbitrary code or cause a denial of service. The vulnerability is associated with a...

PT-2024-7248 · D Link · D-Link Dsl-2750U

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2750U version R5B017 Description: A vulnerability has been found in the Port Forwarding Page component of D-Link DSL-2750U. The manipulation of the PortMappingDescription argument leads to cross-site scripting. It is possible to...

PT-2024-29493 · Unknown · Canarytokens

Name of the Vulnerable Software and Affected Versions: Canarytokens versions prior to sha-8ea5315 Description: Canarytokens help track activity and actions on a network. The Webhook alert feature in Canarytokens.org was vulnerable to a blind Server-Side Request Forgery SSRF prior to sha-8ea5315...

CVE-2023-35722

NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists withi...

CVE-2023-35722

NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists withi...

CVE-2023-35722

NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists withi...

CVE-2023-35722

CVE-2023-35722 affects NETGEAR RAX30 routers. The flaw is in UPnP port-mapping request handling where unvalidated user input is used to execute a system call, enabling remote code execution with root privileges. Exploitation is possible without authentication and occurs from a network-adjacent po...

NETGEAR RAX30 安全漏洞

The NETGEAR RAX30 is a wireless router from NETGEAR. The NETGEAR RAX30 suffers from a command injection vulnerability that stems from a command injection vulnerability when processing UPnP port mapping requests, which can be exploited by an attacker to execute arbitrary commands...

The vulnerability of the formSetPortMapping() function (/goform/SetPortMapping) in the Tenda W15E router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetPortMapping function /goform/SetPortMapping of the Tenda W15E router software is related to the issue of the operation going beyond the buffer in memory when processing parameters such as portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal,...

CVE-2024-4123

A vulnerability, which was classified as critical, has been found in Tenda W15E 15.11.0.14. Affected by this issue is the function formSetPortMapping of the file /goform/SetPortMapping. The manipulation of the argument...

CVE-2024-4117

A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. Affected by this issue is the function formDelPortMapping of the file /goform/DelPortMapping. The manipulation of the argument portMappingIndex leads to stack-based buffer overflow. The attack may be launched remotely...

Tenda W15E 安全漏洞

W15E is a wireless router from Shenzhen Jixiang Tengda Technology Co. Ltd. W15E version 15.11.0.14 has a buffer overflow vulnerability, the vulnerability stems from the formDelPortMapping method of the /goform/DelPortMapping file's portMappingIndex parameter fails to correctly validate the length...

Tenda W15E 安全漏洞

Shenzhen Jixiang Tenda Technology Co., Ltd W15E is a wireless router from China Tenda Tenda. A buffer overflow vulnerability exists in the W15E version 15.11.0.14, which is caused by the portMappingServer/portMappingProtocol/portMappingWan/porMappingtInternal/portMappingExternal parameter of the...

PT-2024-3211 · Tenda · Tenda W15E

Name of the Vulnerable Software and Affected Versions: Tenda W15E version 15.11.0.14 Description: The issue is related to the function formDelPortMapping of the /goform/DelPortMapping endpoint, which is affected by a stack-based buffer overflow when handling the portMappingIndex parameter. This c...

PT-2024-3219 · Tenda · Tenda W15E

Name of the Vulnerable Software and Affected Versions: Tenda W15E version 15.11.0.14 Description: A critical issue has been found in the function formSetPortMapping of the file /goform/SetPortMapping. The manipulation of the arguments portMappingServer, portMappingProtocol, portMappingWan,...

CVE-2024-2188

Cross-Site Scripting XSS vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability could allow an unauthenticated attacker to create a port mapping rule via a SOAP request and store a malicious JavaScript payload within that rule, which could...

CVE-2024-2188

Cross-Site Scripting XSS vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability could allow an unauthenticated attacker to create a port mapping rule via a SOAP request and store a malicious JavaScript payload within that rule, which could...