Huawei iBMC Detection (UPnP)

UPnP based detection of Huawei iBMC over UPnP. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-10059

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlinkdir615upexec.rb 2025-10-23 21:12:57+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:48:30+00:00| seen|...

Attackers Use UPnP to Sidestep DDoS Defenses

Universal Plug and Play networking protocols have never been a friend of security researchers. On Monday, Imperva gave the InfoSec community another reason to dislike UPnP. In a proof-of-concept Distributed Denial of Service DDoS attack, Imperva researchers have devised a way to exploit the UPnP...

New DDoS Attack Method Demands a Fresh Approach to Amplification Assault Mitigation

Amplification attack vectors are some of the most commonly used tools in the DDoS attacker’s arsenal. In the last quarter of 2017, we saw NTP amplification employed in roughly 33 percent of all DDoS assaults against our customers, while DNS and SSDP amplification vectors played a part in 17 perce...

Sql injection

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter...

CVE-2018-8914

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter...

CVE-2018-8914

The CVE-2018-8914 issue affects Synology Media Server’s UPnP DMA, where a SQL injection allows remote execution of arbitrary SQL commands via the ObjectID parameter. Affected versions are prior to 1.7.6-2842 and prior to 1.4-2654. The vulnerability is rooted in improper handling of the ObjectID i...

Western Digital My Cloud EX2 NAS Device Leaks Files

UPDATE Western Digital’s My Cloud EX2 storage devices leak files to anyone on a local network by default, no matter the permissions set by users. If configured for remote access via the public internet, the My Cloud EX2 also leaks files via an HTTP request on port 9000, according to researchers a...

By CVE-2017-17215 learning router vulnerability analysis, from into the pit to give up-vulnerability warning-the black bar safety net

Basic information: 2017/11/27, Check Point Software Technologies sector reported a Huawei HG532 product remote commands execution vulnerabilityCVE-2017-17215, the Mirai an upgraded version of the variant has been used in the vulnerability. Looks like a very simple vulnerabilities, and the book...

Sonos Device/OS/App Detection (UPnP, TCP)

UPnP based detection of Sonos devices, Sonos OS and application. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Universal Plug and Play (UPnP): What you need to know

Universal Plug and Play UPnP is a widely used protocol with a decade-long history of flawed implementations across a wide range of consumer devices. In this paper, we will cover how these aws are still present on devices, how these vulnerabilities are actively being abused, and how a...

OS Identification : UPnP

Binary data osfingerprintupnp.nbin...

TwonkyMedia Server 7.0.11-8.5 Cross Site Scripting

--------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS Date: 2018-03-27 Exploit Author: Sven Fassbender Contact: https://twitter.com/mezdanak...

TwonkyMedia Server 7.0.11-8.5 Directory Traversal

--------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Directory Traversal Date: 2018-03-27 Exploit Author: Sven Fassbender Contact:...

TwonkyMedia Server 7.0.11-8.5 - Directory Traversal Exploit

Exploit for multiple platform in category web applications ''' --------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Directory Traversal Date: 2018-03-27...

TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting Vulnerability

Exploit for multiple platform in category web applications --------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS Date: 2018-03-27 Exploit...

TwonkyMedia Server 7.0.11-8.5 - Directory Traversal

''' --------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Directory Traversal Date: 2018-03-27 Exploit Author: Sven Fassbender Contact:...

TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting

TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting --------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS Date: 2018-03-27 Exploit...

(0Day) Belkin Wemo Link and Smart Plug UPNP changeFriendlyName Buffer Overflow Denial of Service Vulnerability

This vulnerability allows attackers on the local network to create a denial-of-service condition on the Belkin Wemo Link and Smart Plug device, despite factory resets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML parsing in the...

Some Basic Rules for Securing Your IoT Stuff

Most readers here have likely heard or read various prognostications about the impending doom from the proliferation of poorly-secured "Internet of Things" or IoT devices. Loosely defined as any gadget or gizmo that connects to the Internet but which most consumers probably wouldn't begin to know...