ADTRAN SmartRG Router 安全漏洞

ADTRAN SmartRG Router is a series of routers from ADTRAN USA. A security vulnerability exists in ADTRAN SmartRG Router version 2.6.13 that stems from the presence of a remote code execution vulnerability...

D-Link DIR-816 访问控制错误漏洞

The D-Link DIR-816 is a wireless router from China-based AUO D-Link. A security vulnerability exists in the D-Link DIR-816 firmware A2v1.10CNB04.img image, which stems from its /goform/setMAC component that allows an attacker to reset the network without authentication...

TCL LinkHub Mesh Wi-Fi confctl_set_wan_cfg denial of service vulnerability

Talos Vulnerability Report TALOS-2022-1506 TCL LinkHub Mesh Wi-Fi confctlsetwancfg denial of service vulnerability August 1, 2022 CVE Number CVE-2022-27178 SUMMARY A denial of service vulnerability exists in the confctlsetwancfg functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A...

CVE-2022-32988

Cross Site Scripting XSS vulnerability in router Asus DSL-N14U-B1 1.1.2.3805 via the "list" parameters e.g. filterlwlist, keywordrulelist, etc in every ".asp" page containing a list of stored strings. The following asp files are affected: 1 cgi-bin/APPInstallation.asp, 2...

CVE-2022-32988

Cross Site Scripting XSS vulnerability in router Asus DSL-N14U-B1 1.1.2.3805 via the "list" parameters e.g. filterlwlist, keywordrulelist, etc in every ".asp" page containing a list of stored strings. The following asp files are affected: 1 cgi-bin/APPInstallation.asp, 2...

Router security in 2021

A router is a gateway from the internet to a home or office — despite being conceived quite the opposite. Routers are forever being hacked and infected, and used to infiltrate local networks. Keeping this gate locked so that no one can stroll right through is no easy task. It is not always clear...

CVE-2022-28584

It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU v7.4cu.2313b20191024 router, which allows an attacker to execute arbitrary commands through a carefully constructed payload...

CVE-2022-28584

CVE-2022-28584 affects TOTOLINK A7100RU router (firmware 7.4cu.2313_b20191024). The vulnerability is a command injection in the setWiFiWpsStart interface that could allow an attacker to execute arbitrary commands. CVSS data from NVD indicates NETWORK access, no authentication, low attack complexi...

Razer Sila 2.0.418 Local File Inclusion

Exploit Title: Razer Sila - Local File Inclusion LFI Google Dork: N/A Date: 4/9/2022 Exploit Author: Kevin Randall Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila Version:...

iRZ Mobile Router - CSRF to RCE

Exploit Title: iRZ Mobile Router - CSRF to RCE Google Dork: intitle:"iRZ Mobile Router" Date: 2022-03-18 Exploit Author: Stephen Chavez & Robert Willis Vendor Homepage: https://en.irz.ru/ Software Link: https://github.com/SakuraSamuraii/ez-iRZ Version: Routers through 2022-03-16 Tested on: RU21,...

New Variant of Russian Cyclops Blink Botnet Targeting ASUS Routers

ASUS routers have emerged as the target of a nascent botnet called Cyclops Blink, almost a month after it was revealed the malware abused WatchGuard firewall appliances as a stepping stone to gain remote access to breached networks. According to a new report published by Trend Micro, the botnet's...

CVE-2021-44827

CVE-2021-44827 affects TP-Link Archer C20i (firmware 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n). It enables remote authenticated OS command injection via the HTTP parameter X_TP_ExternalIPv6Address, allowing execution of arbitrary commands with root privileges. Affected device exposed over networ...

Command injection

A command injection vulnerability in the function recvmeshinfosync of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2021-41441

CVE-2021-41441 affects D-Link DIR-X1860 before v1.10WWB09_Beta. A DoS via the web interface allows a remote unauthenticated attacker to reboot the router by sending a crafted URL to an authenticated victim who must visit it. Remediation: upgrade to v1.10WWB09 Beta or later (or apply vendor guidan...

D-Link Dir-X1860 安全漏洞

The D-Link Dir-X1860 is a dual-band router from D-Link, a Chinese company. A specially designed URL to an authenticated victim to reboot the router. The authenticated victim would need to access the URL in order for the router to reboot...

CVE-2020-14110

AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background...

CVE-2020-14110

AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background...

Hardcoded credentials

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

CVE-2021-45612

CVE-2021-45612 affects a wide range of NETGEAR router/ extender models (e.g., CBR40, CBR750, EAX20/EAX80, EX7500, LAX20, MK62, MR60, R6400v2, R7000/7000P, R7850, R7900/7900P, R8000/8000P, RAX-series, XR-series, etc.). The vulnerability is a command injection by an unauthenticated attacker, impact...

CVE-2021-20139

The CVE-2021-20139 entry concerns Gryphon Tower routers, where an unauthenticated command injection affects the controller_server service (operation 3). A remote attacker on the same network can send a crafted packet to the controller_server on port 9999 to execute commands as root on the device....