Characterization-and-Detection-of-Cross-Router-Covert-Channels

Characterization and Detection of Cross-Router Covert Channels This repository contains the source code used in the paper "Characterization and Detection of Cross-Router Covert Channels". To access the paper, go to Dr. Oren's laboratory website: orenlab. The full data used in the paper is...

RSC_Detector

RSC Fingerprint Detector A Chrome extension for detecting React Server Components RSC and Next.js App Router fingerprints on web pages. ⚠️ Important Notice This extension is designed for educational and security research purposes only. It includes functionality that could be used to test for...

Home-Network-Vulnerability-Assessment

Home-Network-Vulnerability-Assessment Security audit and vulnerability analysis CVE-2014-3566 and CVE-2010-2333 on the local network infrastructure and residential router. Security Audit and Vulnerability Analysis on Residential Router Project Description This project documents a perimeter securi...

blogpost_cve-2018-19987-analysis

CVE-2018-19987 D-Link OS command injection analysis Hello there! In this short blog post I'll break down a quick analysis that I performed to better understand the details behind CVE-2018-19987. At the beginning I went after this CVE because I thought that there wasn't any public information or...

CVE-2020-29669

=============== Macally WIFISD2-2A82 Writeup for CVE-2020-29669 by Maximilian Barz Silky and Daniel Schwendner code-byter ========================== This is a writeup of exploiting the Macally WIFISD2-2A82 Travel Router Firmware version: 2.000.010. The Guest user is able to reset its own password...

CVE-2020-35391

CVE-2020-35391 Tenda f3 Malformed HTTP Request Header Processing Vulnerability. Run python3 CVE-2020-35391.py --help python3 CVE-2020-35391.py python3 CVE-2020-35391.py -i http://127.0.0.1:8080 python3 CVE-2020-35391.py -l ip.txt Tenda F3 Shodan Dork Exploitation...

CVE-2022-25061

CVE-2022-25061 This script exploits a remote command execution vulnerability under the oalsetIp6DefaultRoute component in the TPLink WR840N router...

CVE-2020-16898

CVE-2020-16898: “Bad Neighbor” CVSS Score: 8.8 CVSS Vector: CVSS3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C Overview On October 13, Microsoft announced an exceptionally critical vulnerability in the Windows IPv6 stack, which allows an attacker to send maliciously crafted packets to...

CVE-2024-57725

CVE-2024-57725: GPON Link Manipulation Vulnerability in certain Arcadyan Routers Distributed by Orange and Jazztel This repository documents an unauthenticated vulnerability discovered in LiveboxFibra Arcadyan routers distributed by Orange and Jazztel in Spain PRV3399BBLT. The issue lies in the...

GPON_RCE

GPONRCE Exploit for Remote Code Execution on GPON home routers CVE-2018-10562 written in Python...

routopsy

routopsy Routopsy is a toolkit built to attack often overlooked networking protocols. Routopsy currently supports attacks against Dynamic Routing Protocols DRP and First-Hop Redundancy Protocols FHRP. Most of the attacks currently implemented make use of a weaponised 'virtual router' as opposed t...

CVE-2026-26898-Xiaomi-SSRF-HostHeaderInjection

CVE-2026-26898: Xiaomi Mi Router 4A Gigabit - SSRF via Host Header Injection -orange Summary A Server-Side Request Forgery SSRF vulnerability exists in the Xiaomi Mi Router 4A Gigabit Edition. The router's web interface fails to validate the HTTP Host header, allowing an unauthenticated attacker ...

Spring Framework Path Traversal in Functional Web Frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Blink Router - Command Injection

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bsSetSSIDHide function. id: CVE-2025-45985 info: name: Blin...

Wavlink WN535K2/WN535K3 - OS Command Injection

Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection which affects unknown code in /cgi-bin/nightled.cgi via manipulation of the argument starthour. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised syste...

SDT-CW3B1 1.1.0 - OS Command Injection

Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication. id: CVE-2021-46422 info: name: SDT-CW3B1 1.1.0 - OS Command Injection author: badboycxcc,prajiteshsingh severity: critical description: ...

NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has ...

ASUS DSL-AC88U - Authentication Bypass

A vulnerability in the ASUS DSL-AC88U router permits unauthorized individuals to bypass authentication.When adding "/js/..%2f%2f" or "/images/..%2f%2e" to the requested URL, it will be recognized as passing the authentication.This vulnerability is part of a broader authentication bypass issue...

MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion

MERCUSYS Mercury X18G 1.0.5 devices are vulnerable to local file inclusion via ../ in conjunction with a loginLess or login.htm URI for authentication bypass to the web server, as demonstrated by the /loginLess/../../etc/passwd URI. id: CVE-2021-23241 info: name: MERCUSYS Mercury X18G 1.0.5 Route...

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...