PT-2021-13795

Name of the Vulnerable Software and Affected Versions: Gryphon Tower router affected versions not specified Description: An unauthenticated command injection issue exists in the Gryphon Tower router’s web interface at "/cgi-bin/luci/rc". This allows an unauthenticated remote attacker on the same...

PT-2021-13797

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 10 in the controller server service. This allows an unauthenticated remote attacker on the sam...

CVE-2021-20139: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to...

CVE-2021-20138: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to th...

CVE-2021-20137: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/siteaccess/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution...

CVE-2021-20142: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20141: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20140: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20145: Improper Authentication

Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the LAN interfaces of other users' devices connected to the same service. An attacker could leverage this to make configuration changes to, o...

CVE-2021-20144: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20143: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

Gryphon Tower operating system command injection vulnerability

The Gryphon Tower is a wireless router from Gryphon. A command injection vulnerability exists in Gryphon Tower, which originates from the failure of the parameters of operation 32 in the controllerserver service on the router to correctly filter special characters, commands, etc. entered by the...

Gryphon Tower cross-site scripting vulnerabilities

A cross-site scripting vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from a lack of user-supplied data and output data validation filtering in the url parameter of cgi-bin/luci/siteaccess/, which can be exploited to execute client-side JavaScript...

Gryphon Tower operating system command injection vulnerability

The Gryphon Tower is a wireless router from Gryphon. The Gryphon Tower suffers from a command injection vulnerability that originates from unauthenticated command injections in multiple parameters in the web interface of /cgi-bin/luci/rc, which can be exploited by an attacker to send a crafted...

Gryphon Tower Authorization Issue Vulnerability

Gryphon Tower is a wireless router from Gryphon, Inc. Gryphon Tower is vulnerable to an authorization issue that could be exploited by attackers to make configuration changes to the device...

PT-2021-13796

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 3 in the controller server service. An unauthenticated remote attacker on the same network can...

Gryphon Tower operating system command injection vulnerability

Gryphon Tower is a wireless router from Gryphon, Inc. A command injection vulnerability exists in Gryphon Tower, which stems from the failure to properly filter user input for special characters, commands, etc. in the controllerserver service on the router, which could be exploited by a remote,...

Gryphon Tower operating system command injection vulnerability

A command injection vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from the failure to properly filter the parameters of operation 41 in the controllerserver service on the router for special characters and commands entered by the user, which could ...

PT-2021-13800

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 48 in the controller server service. An unauthenticated remote attacker on the same network ca...

PT-2021-13801

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 49 in the controller server service. An unauthenticated remote attacker on the same network ca...