PT-2023-9251 · Actiontec · Actiontec Wcb6200Q

Name of the Vulnerable Software and Affected Versions: Actiontec WCB6200Q affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. The specific flaw exists within the HTTP server,...

PT-2023-9252 · Actiontec · Actiontec Wcb6200Q

Name of the Vulnerable Software and Affected Versions: Actiontec WCB6200Q affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. The flaw exists within the HTTP server, where a...

The vulnerability of the phpcgi_main function in the D-Link DIR-859 router’s microprogramming system allows a hacker to increase their privileges.

The vulnerability of the phpcgimain function in the D-Link DIR-859 router’s microprogramming system is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...

PT-2023-4143 · Asus · Asus Rt-Ax88U

Name of the Vulnerable Software and Affected Versions: ASUS RT-AX88U affected versions not specified Description: The issue is related to an error in the do json decode function of the ej.c file in the ASUS RT-AX88U router's firmware, which can cause a buffer overflow. A remote attacker can explo...

D-Link DIR-859 安全漏洞

The D-Link DIR-859 is a wireless router from China's AUO D-Link. The D-Link DIR-859 suffers from an authentication bypass vulnerability that stems from a lack of valid authentication in phpcgimain, which can be exploited by an attacker to bypass authentication...

D-LINK DIR-815 安全漏洞

The D-Link DIR-815 is a wireless router from China-based AUO D-Link. A security vulnerability exists in the D-LINK DIR-815 v1.01, which stems from the discovery of a contained buffer overflow vulnerability via component /web/captcha.cgi...

The vulnerability of D-Link DSL-224 router microprogramming software, related to insufficient limits on authentication attempts, allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of D-Link DSL-224 router microprogramming software is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

TOTOLINK A3300R 操作系统命令注入漏洞

TOTOLINK A3300R is a dual-band wireless router manufactured by China's Gion Electronics TOTOLINK, mainly used for home and small network environments. A command injection vulnerability exists in the TOTOLINK A3300R. The vulnerability stems from the command parameter of the setTracerouteCfg method...

Nexxt Nebula 1200-AC 安全漏洞

The Nexxt Nebula 1200-AC is a wireless router from Nexxt USA. A security vulnerability exists in the Nexxt Nebula 1200-AC version 15.03.06.60, which originates from using the HTTPD service to enable TELNET to bypass authentication and command execution...

The vulnerability of the D-LINK GO-RT-AC750 router’s microprogramming software lies in the lack of measures to neutralize special elements, allowing a hacker to execute arbitrary commands.

The vulnerability of the D-LINK GO-RT-AC750 router’s microprogramming software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the genacgimain parameter...

CVE-2023-33277

The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 allows a remote attacker to read sensitive files via directory-traversal sequences in the URL...

The vulnerability of NETGEAR RAX30 router microprogramming software lies in the improper handling of symbolic links before accessing the file, allowing attackers to disclose confidential information.

The vulnerability of NETGEAR RAX30 router microprogramming software is related to the incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to disclose confidential information...

Tenda AC6 跨站脚本漏洞

The Tenda AC6 is a wireless router from Tenda, China. The Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50multi suffers from a cross-site scripting vulnerability, which stems from a cross-site scripting XSS vulnerability found in the deviceId parameter of the Parental Control module...

Adslr VW2100 命令注入漏洞

The Adslr VW2100 is a router from Flying Fish Star Technology Adslr, Chengdu, China. A security vulnerability exists in the Adslr VW2100 M1DV version 1.0. An attacker exploited the vulnerability to execute system commands as root user...

ASUS RT-N10LX 缓冲区错误漏洞

ASUS RT-N10LX is a router from Asus China. A security vulnerability exists in ASUS RT-N10LX Router version v2.0.0.39, which was discovered to contain a stack overflow vulnerability via the url parameter of /start-apply.html...

PT-2023-25069 · Asus · Asus Rt-N10Lx Router

Name of the Vulnerable Software and Affected Versions: Asus RT-N10LX Router version 2.0.0.39 Description: A stored cross-site scripting XSS issue in the urlFilterList function allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL Keyword List text...

Tenda AC10 缓冲区错误漏洞

Tenda AC10 is a wireless router from Tenda China. A security vulnerability exists in the Tenda AC10 v4 USAC10V4.0siV16.03.10.13cn version, which stems from a discovery via the list parameter of /goform/SetVirtualServerCfg that contains a stack overflow issue...

Metasploit Weekly Wrap-Up

Cloud Fun With EC2 New ground was broken today with the addition of two PRs from community contributor sempervictus, also known as RageLtMan, who added the ability for Metasploit to establish sessions to EC2 instances using Amazon's SSM interface, which provides a public API to execute commands o...

CVE-2023-33537

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/FixMapCfgRpm...

The vulnerability of the GetFirmwareStatus function in the application software interface of D-Link DIR-2150 router software allows a hacker to execute arbitrary code.

The vulnerability of the GetFirmwareStatus function in the application software interface of D-Link DIR-2150 router microprogramming devices is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using specially...