Command injection

An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Stack overflow

A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Directory traversal

A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to FsTFtp file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Command injection

An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this...

Directory traversal

A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to local file inclusion. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Stack overflow

A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Stack overflow

A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2021-21896

A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to arbitrary file deletion. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2021-21896

The CVE-2021-21896 vulnerability affects Lantronix PremierWave 2050 Web Manager FsBrowseClean, allowing an authenticated user to trigger a directory traversal via crafted HTTP parameters (notably path) to delete arbitrary files within /ltrx_user/. Talos provides the core details and PoC, confirmi...

CVE-2021-21895

Summary: CVE-2021-21895 is a directory traversal vulnerability in the Web Manager FsTFtp feature of Lantronix PremierWave 2050 (version 8.9.0.0R4, in QEMU). The flaw arises from insufficient input validation in the FsTFtp Web Manager when handling the cwd parameter, enabling an authenticated user...

CVE-2021-21895

A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to FsTFtp file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2021-21892

A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2021-21894

The CVE-2021-21894 vulnerability affects Lantronix PremierWave 2050 (Web Manager FsTFtp) and is detailed in Talos as a directory traversal flaw in FsTFtp that can be exploited by an authenticated HTTP request to perform arbitrary file disclosure/overwrite. The flaw arises from insufficient saniti...

CVE-2021-21894

A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to arbitrary file overwrite FsTFtp file disclosure. An attacker can make an authenticated HTTP request to trigger this...

CVE-2021-21892

Lantronix PremierWave 2050 Web Manager FsUnmount stack-based buffer overflow vulnerability (CVE-2021-21892) affects version 8.9.0.0R4 (in QEMU). Root cause: insecure use of sprintf with user-controlled path parameter during FsUnmount handling, overflowing a stack buffer and enabling remote code e...

CVE-2021-21891

A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution in the vulnerable portion of the branch deletefile. An attacker can make an...

CVE-2021-21891

CVE-2021-21891 refers to a stack-based buffer overflow in Lantronix PremierWave 2050 Web ManagerFsBrowseClean (QEMU 8.9.0.0R4). The vulnerability arises in the handling of POST parameters action, path and dir, with unchecked sprintf into a 4120-byte buffer (buff) when action is deletedir or delet...

CVE-2021-21890

CVE-2021-21890 is a stack-based buffer overflow in Lantronix PremierWave 2050 Web Manager (FsBrowseClean) affecting version 8.9.0.0R4 (QEMU). The vulnerability arises from two vulnerable paths where an authenticated user’s POST parameters (action, path, dir) are assembled via unchecked sprintf in...

CVE-2021-21890

A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution in the vulnerable portion of the branch deletedir. An attacker can make an...

CVE-2021-21889

A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...