CVE-2023-33381-MitraStar-GPT-2741GNAC

CVE-2023-33381-MitraStar-GPT-2741GNAC CVE-2023-33381: MitraStar GPT-2741GNAC의 OS 명령어 주입 장치: GPT-2741GNAC 펌웨어 버전: ARg5.8110WVN0b72 취약점 설명: SSH로 로그인하자마자 사용 가능한 명령어와 옵션이 제한되어 있음을 알게 되었습니다. 확실히 제한된 셸 환경에 갇혀 있다는 것이 분명해졌습니다. 몇 가지 알려진 취약점을 탐색한 후, 새로운 취약점을 찾기 위해 깊이 파고들기로 결정했습니다. 먼저 관리 포털에 로그인하여 OS 명령어 주입...

mcafee_atd_CVE-2019-3663

McAfee ATD CVE-2019-3663 McAfee Advanced Threat Defense ATD 4.6.x 및 이전 버전 - 하드코딩된 루트 비밀번호 보안 게시판: https://kc.mcafee.com/corporate/index?page=content&id=SB10304 흥미로운 shadow 항목들 root:$6$hHb7yjP/$JY9Zf8jFCL966X8rbOqerkuXR86AUMl4bNCuDiEgoXWZEE5dWssWvnokv.54YG4/KRQuNbZBiUWur2/Tj4uUf0:18030:0:99999:7::...

Privilege-escalation-ASKEY

Privilege-escalation-ASKEY-Router-RTF3505VW-N1 CVE-2022-47040 ASKEY ルーターにおける権限昇格の脆弱性 デバイス: ASKEY RTF3505VW-N1 ファームウェア: BRSVg000R3505VMN1001s327（他のバージョンでは未テスト） CLI バージョン: ReducedCLIHGUv13 エクスプロイト： ASKEY RTF3505VW-N1 デバイスには、SSH 経由で制限付きデフォルトシェルへのアクセスが提供されています： 制限付きシェルは "ReducedCLI" にアクセスでき、ほとんどの...

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1790267010)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1790267010 advisory. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell...

rsync: rsync: Directory escape via TOCTOU race condition in rrsync

A time-of-check to time-of-use TOCTOU race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended...

CVE-2026-53783

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...

CVE-2026-53783

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...

EUVD-2026-58090

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...

CVE-2026-23820

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlyin...

CVE-2026-23820

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlyin...

CVE-2026-23820 Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlyin...

CVE-2026-23820 Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlyin...

CVE-2026-23820

CVE-2026-23820 affects Access Points running AOS-10 Instant and AOS-8 Instant. The description identifies an input filtering weakness in the CLI that allows an authenticated remote attacker to execute system commands in a restricted shell, potentially leading to arbitrary OS commands. The NVD/CVE...

Hewlett Packard Enterprise ArubaOS 操作系统命令注入漏洞

Hewlett Packard Enterprise ArubaOS is a network wireless operating system developed by Hewlett Packard Enterprise. Hewlett Packard Enterprise ArubaOS has a vulnerability related to operating system command injection. This vulnerability stems from a flaw in the command-line interface, which may...

PT-2026-40337

Name of the Vulnerable Software and Affected Versions Access Points running AOS-10 affected versions not specified Access Points running AOS-8 Instant affected versions not specified Description A flaw in the command line interface allows an authenticated remote attacker to execute system command...

CLSA-2026-1777446568 bash: Fix of CVE-2019-9924

CVE-2019-9924: reject attempts to add pathnames containing slashes to the hash table in restricted shell...

bash: Fix of CVE-2019-9924

CVE-2019-9924: reject attempts to add pathnames containing slashes to the hash table in restricted shell...

CLSA-2026-1777367927 bash: Fix of CVE-2019-9924

CVE-2019-9924: reject attempts to add pathnames containing slashes to the hash table in restricted shell...

CVE-2025-31703

A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's authentication mechanism to escalate privileges...

CVE-2026-23759

Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6.0 allow authenticated OS command injection via the restricted shell accessed over Telnet or SSH. The shell 'ps' command does not perform proper argument sanitization and passes user-supplied parameters into an 'sh -c'...