CVE-2020-27691

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings...

CVE-2020-27692

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings responsible for managing devices remotely. This makes it possibl...

CVE-2020-27690

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains a buffer overflow within its web management portal. When a POST request is sent to /boaform/admin/formDOMAINBLK with a large blkDomain value, the Boa server crashes...

CVE-2020-27689

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A remote attacker could exploit this vulnerability to login and execute commands on the device, as well as upgrade the firmware image to a...

CVE-2020-27691

The CVE-2020-27691 entry concerns the Verve Connect VH510 (Relish) gateway. Affected firmware versions prior to 1.0.1.6L0516 are vulnerable to cross-site scripting (XSS) via the device’s UI settings pages: URLBlocking, SNMP, and System Log settings. The root cause is an input handling flaw in the...

PT-2020-16768

Name of the Vulnerable Software and Affected Versions Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 Description The Relish Verve Connect VH510 device contains multiple CSRF vulnerabilities within its web management portal. Attackers can use this to update the TR-069...

PT-2020-16765

Name of the Vulnerable Software and Affected Versions The Relish Verve Connect VH510 device with firmware prior to 1.0.1.6L0516 Description The issue concerns undocumented default admin credentials for the web management interface. A remote attacker could exploit this to login and execute command...

PT-2020-16766

Name of the Vulnerable Software and Affected Versions Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 Description The issue concerns a buffer overflow within the web management portal of the device. This occurs when a POST request is sent to the "/boaform/admin/formDOMAINBLK"...

PT-2020-16767

Name of the Vulnerable Software and Affected Versions Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 Description The issue allows for cross-site scripting XSS attacks via the URLBlocking Settings, SNMP Settings, and System Log Settings. This could potentially lead to maliciou...

CVE-2020-27690: Buffer Copy without Checking Size of Input

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains a buffer overflow within its web management portal. When a POST request is sent to /boaform/admin/formDOMAINBLK with a large blkDomain value, the Boa server crashes...

CVE-2020-27689: Use of Hard-coded Credentials

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A remote attacker could exploit this vulnerability to login and execute commands on the device, as well as upgrade the firmware image to a...

CVE-2020-27692: Cross-Site Request Forgery (CSRF)

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings responsible for managing devices remotely. This makes it possibl...

CVE-2020-27691: Improper Neutralization of Input During Web Page Generation

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings...