PT-2014-3569

Name of the Vulnerable Software and Affected Versions Huawei Echo Life HG8247 routers versions prior to V100R006C00SPC127 Description A cross-site scripting XSS issue exists in the web interface, allowing remote attackers to inject arbitrary web script or HTML via a crafted username in an invalid...

CVE-2014-0337: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during...

FreePBX Framework Module view.functions.php Remote Code Execution

Added: 04/03/2014 CVE: CVE-2014-1903 BID: 65509 OSVDB: 103240 Background FreePBX is an open source telephony front-end, which has an easy to use graphical user interface that controls and manages Asterisk. Problem The Framework module of FreePBX is vulnerable to remote code execution as a result ...

Default Password (ironport) for 'enablediag' Account

The account 'enablediag' on the remote host has the password 'ironport'. An attacker may leverage this issue to gain access to the affected system and launch further attacks against it. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "enablediag"; password = "ironport";...

3Com Switch Default Admin Credentials

The remote device is a 3Com Switch that uses a set of known, default credentials. Knowing these, an attacker able to connect to the service can gain control of the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

cURL/libcURL SSL证书验证安全限制绕过漏洞

BUGTRAQ ID: 66296 CVE ID: CVE-2014-2522 cURL是命令行传输文件工具，支持FTP、FTPS、HTTP、HTTPS、GOPHER、TELNET、DICT、FILE和LDAP。 cURL/libcURL在服务器证书的验证上存在安全漏洞，成功利用后可导致中间人攻击或服务器欺骗。 0 cURL 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://curl.haxx.se/...

CVE-2014-2321

webshellcmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials...

Design/Logic Flaw

webshellcmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials...

PT-2014-4623

Name of the Vulnerable Software and Affected Versions ZTE F460 and F660 cable modems affected versions not specified Description The issue allows remote attackers to obtain administrative access. This can be achieved by sending sendcmd requests, for example, using "set TelnetCfg" commands to enab...

CVE-2014-2321

webshellcmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using “set TelnetCfg” commands to enable a TELNET service with specified credentials. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...

NETGEAR Hard-coded Telnet Unlock Credentials

The remote NETGEAR device has a hard-coded set of credentials that can be sent in a specially encoded packet in order to unlock the telnet service and allow remote logins as the root user. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid72831; scriptversion"1.6";...

NETGEAR DGN2200 Multiple Vulnerabilities

Nessus was able to determine that the remote device is a NETGEAR DGN2200. This device is affected by multiple vulnerabilities, the worst of which allow an unauthenticated, adjacent attacker to gain root telnet access to the device. C Tenable Network Security, Inc. include"compat.inc"; if...

ZTE ZXV10 W300 Wireless Router Hard-coded Password

Nessus was able to login to the remote device using a known hard-coded password prepended with a portion of the device's MAC address obtained from an SNMP request for the admin account. Attackers can exploit this vulnerability to gain full control of the device. TRUSTED...

[SECURITY] Fedora 19 Update: curl-7.29.0-13.fc19

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

NetGear DGN2200 N300 CSRF / Disclosure / Command Execution

Title: Multiple vulnerabilities in NETGEAR N300 WIRELESS ADSL2+ MODEM ROUTER DGN2200 ==================================================================================== Notification Date: 11 February 2014 Affected Vendor: NetGear Affected Hardware: NetGear DGN2200 N300 Wireless ADSL2+ Modem Rout...

ZTE ZXV10 W300 Router信任管理漏洞

CVE ID：CVE-2014-0329 ZTE ZXV10 W300 Router是中国中兴通讯（ZTE）公司的一款无线路由器产品。 ZTE ZXV10 W300路由器2.1.0版本上的TELNET服务中存在安全漏洞，该漏洞源于程序安装使用默认的硬编码凭证，将admin帐户密码‘XXXXairocon’中的前四位设置为MAC地址后四位。远程攻击者可通过已知的密码利用该漏洞获取管理访问权限。 0 ZTE ZXV10 W300 Router 厂商补丁： ZTE ----- 目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接：...

ZTE ZXV10 W300 Wireless Router Hardcoded Credentials Security Bypass Vulnerability (SNMP/Telnet)

ZTE ZXV10 W300 wireless router is prone to a security-bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Netgear D6300B routers backdoor

Specially crafted network packet activates root level telnet access...

Security Advisory: NETGEAR Router D6300B Firmware: V1.0.0.14_1.0.14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory ID: SYSS-2013-001 Product: NETGEAR Router D6300B / Firmware: V1.0.0.141.0.14 latest Vendor: Netgear Affected Versions: until V1.0.0.141.0.14 latest Tested Versions: V1.0.0.141.0.14 latest Vulnerability Type: Root-Shell, OS Command Injection,...

ZTE ZXV10 W300 Router - Hard-Coded Credentials

ZTE ZXV10 W300 Router - Hard-Coded Credentials Exploit Title: ZTE ZXV10 W300 router contains hardcoded credentials Date: 03 Feb 2014 Exploit Author: Cesar Neira Vendor Homepage: http://wwwen.zte.com.cn/ Version: ZTE ZXV10 W300 v2.1 CVE : CVE-2014-0329 Dork Shodan: Basic realm="index.htm"...