TFTP Fetch, Linux Command Shell, Reverse TCP Inline

Fetch and execute an ARMLE payload from a TFTP server. Connect to target and spawn a command shell Module Options msf use payload/cmd/linux/tftp/armle/shellbindtcp msf payloadshellbindtcp show actions ...actions... msf payloadshellbindtcp set ACTION msf payloadshellbindtcp show options ...show an...

PT-2025-7409 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.0 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.9 Hitachi Vantara Pentaho Business Analytics Server version 8.3.x Description: The web serv...

CVE-2022-28194

NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrablcbo.c, where, if TFTP is enabled, a local attacker with elevated privileges can cause a memory buffer overflow, which may lead to code execution, loss of Integrity, limited denial of service, and some impact to...

CVE-2020-35801

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. A TFTP server was found to be active by default. It allows remote authenticated users to...

CVE-2024-23811

A vulnerability has been identified in SINEC NMS All versions V2.0 SP1. The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution...

Korenix JetNet Arbitrary Unauthenticated TFTP Actions (CVE-2020-12504)

Improper Authorization vulnerability of Korenix JetNet 5428G-20SFP, JetNet 5810G, JetNet 4706F, JetNet 4510, JetNet 5310, JetNet 4706, JetNet 5428G, JetNet 6095, JetNet 4706 use an active TFTP-Service. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-o...

Fortinet FortiWeb Buffer overflow in TFTP client library of CLI (FG-IR-21-173)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-173 advisory. - A buffer overflow CWE-121 in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an...

Fortinet Fortigate Buffer overflow in TFTP client library of CLI (FG-IR-21-173)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-173 advisory. - A buffer overflow CWE-121 in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an...

Cisco IOS SNMP File Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco IOS SNMP File Upload TFTP', 'Description' = %q This module will copy file to a Cisco IOS device using SNMP and TFTP. The action...

NetDecision 4.2 TFTP Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "NetDecision 4.2 TFTP Directory Traversal", 'Description' = %q This modules exploits a directory traversal vulnerability in NetDecision 4.2 TFTP...

IpSwitch WhatsUp Gold TFTP Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "IpSwitch WhatsUp Gold TFTP Directory Traversal", 'Description' = %q This modules exploits a directory traversal vulnerability in IpSwitch WhatsUp...

SolarWinds TFTP Server 10.4.0.10 Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SolarWinds TFTP Server 10.4.0.10 Denial of Service' , 'Description' = %q The SolarWinds TFTP server can be shut down by sending a 'netascii' read...

PacketTrap TFTP Server 2.2.5459.0 Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PacketTrap TFTP Server 2.2.5459.0 DoS', 'Description' = %q The PacketTrap TFTP server version 2.2.5459.0 can be brought down by sending a special...

TFTP Brute Forcer

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TFTP Brute Forcer', 'Description' = 'This module uses a dictionary to brute force valid TFTP image names from a TFTP server.', 'Author' =...

General Electric D20ME TFTP Server Buffer Overflow / Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework The General Electric D20 and possibly other devices have numerous buffer overruns in their TFTP servers and probably other servers. There are many buffer overruns like i...

General Electric D20 Password Recovery

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module grabs the device configuration from a GE D20M RTU and parses the usernames and passwords from it. class MetasploitModule 'General Electric D20 Password...

Unable to Bind Provisioning Services TFTP Service to Multiple NICs

Target devices on different non-routable VLANs are unable to connect to the Provisioning Services PVS server that has a NIC bound to each of the non-routable VLANs...

Implementation Guide - High Availability for TFTP with Provisioning Services

This article is an implementation guide on High Availability for TFTP with Provisioning Services...

CVE-2012-6664

Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a .. dot dot in the 1 get or 2 put commands...

CVE-2012-6664

CVE-2012-6664 concerns Distinct Intranet Servers 3.10 and earlier, where the TFTP Server contains multiple directory traversal vulnerabilities. An attacker can read or write arbitrary files by crafting a .. sequence in the get or put commands, enabling remote file write/execution under certain co...