CVE-2019-9121

The CVE-2019-9121 issue affects Motorola C1 and M2 devices (firmware 1.01 and 1.07). A command-injection vulnerability exists in the device OS via the SetSmartQoSSettings API triggered from untrusted input in the /HNAP1 POST request, demonstrated by shell metacharacters in the smartqos_priority_d...

CVE-2019-9117

CVE-2019-9117 affects Motorola C1 and M2 routers (firmware 1.01 and 1.07). A command-injection flaw occurs in the HNAP API: when processing SetNetworkTomographySettings, untrusted input from the request body (e.g., tomography_ping_number) can trigger system() and execute arbitrary OS commands, po...

CVE-2019-9120

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

PT-2019-19371

Name of the Vulnerable Software and Affected Versions Motorola C1 version 1.01 Motorola M2 version 1.07 Description A Command Injection issue allows a remote attacker to execute arbitrary code and gain a root shell. This occurs through a crafted /HNAP1 POST request, where the tomography ping numb...

PT-2019-19374

Name of the Vulnerable Software and Affected Versions Motorola C1 version 1.01 Motorola M2 version 1.07 Description A Command Injection issue allows a remote attacker to execute arbitrary code and gain a root shell. This occurs when the HNAP API function triggers a call to the system function wit...

PT-2019-19375

Name of the Vulnerable Software and Affected Versions Motorola C1 version 1.01 Motorola M2 version 1.07 Description The issue is related to a Command Injection, allowing a remote attacker to execute arbitrary code and gain a root shell. This occurs through a crafted /HNAP1 POST request,...

PT-2019-19372

Name of the Vulnerable Software and Affected Versions Motorola C1 version 1.01 Motorola M2 version 1.07 Description A Command Injection issue allows a remote attacker to execute arbitrary code and gain a root shell. This occurs through a crafted /HNAP1 POST request, where the SetNTPServerSettings...

PT-2019-19373

Name of the Vulnerable Software and Affected Versions Motorola C1 version 1.01 Motorola M2 version 1.07 Description A Command Injection issue allows a remote attacker to execute arbitrary code and gain a root shell. This occurs through a crafted /HNAP1 POST request, where the SetStaticRouteSettin...

CVE-2019-9119: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

CVE-2019-9118: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

CVE-2019-9121: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

CVE-2019-9120: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a...

CVE-2019-9146

Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream...

Code injection

Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream...

CVE-2019-9146

Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream...

CVE-2019-9146

CVE-2019-9146 affects Jamf Self Service 10.9.0. A MITM attacker could leverage the feature to publish Bash shell scripts and inject the string "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream, enabling escalation to a root shell. The base metrics indicate hi...

PT-2019-19390

Name of the Vulnerable Software and Affected Versions Jamf Self Service version 10.9.0 Description The issue allows man-in-the-middle attackers to obtain a root shell. This is achieved by leveraging the "publish Bash shell scripts" feature to insert a specific command into the TCP data stream,...

CVE-2019-9146: Undefined Security Weakness

Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream...

Digi TransPort LR54 Restricted Shell Escape

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2018-20162: Digi TransPort LR54 Restricted Shell Escape =========================================================== The Digi TransPort LR54 is a high speed LTE router commonly used by industry, infrastructure, retail and public transportation. I...

CVE-2019-8312

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...