CVE-2019-14919

An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate via hardcoded credentials into a shell, gaining root execution privileges over the device...

CVE-2019-14920

Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etcro/web/adm/systemcommand.asp shell feature...

CVE-2019-14918

XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etcro/web/internet/dhcpcliinfo.asp...

Design/Logic Flaw

Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etcro/web/adm/systemcommand.asp shell feature...

Hardcoded credentials

An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate via hardcoded credentials into a shell, gaining root execution privileges over the device...

CVE-2019-14920

Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etcro/web/adm/systemcommand.asp shell feature...

CVE-2019-14919

The CVE concerns the Billion Smart Energy Router SG600R2 (firmware v3.02.rc6). An exposed Telnet service allows a local attacker to authenticate using hardcoded credentials, gaining root execution privileges on the device. This directly enables privileged control from the local network. The avail...

CVE-2019-14918

CVE-2019-14918 affects Billion Smart Energy Router SG600R2, Firmware v3.02.rc6. A cross-site scripting (XSS) flaw exists in the DHCP lease-status form/table, allowing an attacker to inject arbitrary HTML/JavaScript through crafted DHCP requests to etc_ro/web/internet/dhcpcliinfo.asp, enabling cli...

CVE-2019-14918

XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etcro/web/internet/dhcpcliinfo.asp...

A week in security (December 30 – January 5)

Last week on Malwarebytes Labs, we took a dive into edge computing, looked at new web skimmer techniques, and rolled our eyes at silly people doing silly things. Other cybersecurity news: Stills and chills: A Reddit user notices their security camera is grabbing stills from other people’s devices...

SIEMENS SIMATIC S7-200 Smart suffers from weak password vulnerability

Siemens is a leading global technology company providing solutions for customers in the areas of power generation and transmission and distribution, infrastructure, industrial automation, drives and software through innovations in electrification, automation and digitalization. A weak password...

Cryptbond Network Override Vulnerability

Cryptbond Network CBN is a cryptocurrency. An override vulnerability exists in the 'ToOwner' function in the smart contract implementation of Cryptbond Network CBN, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to...

Business Alliance Financial Circle (BAFC) Overreach Vulnerability

Business Alliance Financial Circle BAFC is a cryptocurrency. The 'UBSexToken' function in BAFC's smart contract implementation is vulnerable to an overreach vulnerability that stems from the fact that the function is publicly available and does not check the identity of the caller. An attacker...

Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones

There is an information leak vulnerability in some Huawei smart phones. An attacker could send specific command in the local area network LAN to exploit this vulnerability. Successful exploitation may cause information leak. Vulnerability ID: HWPSIRT-2019-10001 This vulnerability has been assigne...

CVE-2018-19831

The ToOwner function of a smart contract implementation for Cryptbond Network CBN, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19832

The NETM function of a smart contract implementation for NewIntelTechMedia NETM, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19833

The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19830

The UBSexToken function of a smart contract implementation for Business Alliance Financial Circle BAFC, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public by default and does not check the caller's identity...

CVE-2018-19834

The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

Code injection

The ToOwner function of a smart contract implementation for Cryptbond Network CBN, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...