PT-2023-13494 · Zebra +1 · Zebra Enterprise Home Screen +1

Name of the Vulnerable Software and Affected Versions: Zebra Enterprise Home Screen version 4.1.19 Description: An issue was discovered in the software, allowing the installation of unauthorized applications via a downloaded APK by utilizing the embedded Google Chrome application. Recommendations...

CVE-2022-36442

CVE-2022-36442 affects Zebra Enterprise Home Screen 4.1.19. The issue arises from the embedded Google Chrome component, enabling installation of unauthorized applications via a downloaded APK. Root cause: abuse of the embedded Chrome within the Zebra app to install software without authorization....

CVE-2022-36441

CVE-2022-36441 affects Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and access several administrator-restricted apps, creating a local impact. CVSS v3.1 base score 7.1 (HIGH). Root cause is not elaborated beyond the interaction between Gboar...

CVE-2022-36443

CVE-2022-36443 affects Zebra Enterprise Home Screen 4.1.19. The issue: the device allows administrators to lock certain communication channels (wireless and SD card) but still permits unrestricted use of a physical Ethernet connection. Root cause details are not provided in the available document...

CVE-2022-36443: Improper Access Control

An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels wireless and SD card but it is still possible to use a physical connection Ethernet cable without restriction...

CVE-2022-36441: Improper Access Control

An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin...

CVE-2022-36442: Improper Access Control

An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized application via a downloaded APK...

Zebra ZTC Printer Web Interface Default Admin Password

The remote host has a web interface with a default administrative password. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid164505; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/08/30"; scriptnameenglish:"Zebra ZTC Printer We...

frr:zebra: Heap-use-after-free in zebra_rnh_resolve_nexthop_entry

Detailed Report: https://oss-fuzz.com/testcase?key=6221403510145024 Project: frr Fuzzing Engine: libFuzzer Fuzz Target: zebra Job Type: libfuzzerasanfrr Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60b000007a18 Crash State: zebrarnhresolvenexthopentry...

zebra-online.com Cross Site Scripting vulnerability OBB-2645901

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

frr:zebra: Crash in model

Detailed Report: https://oss-fuzz.com/testcase?key=5130401121697792 Project: frr Fuzzing Engine: libFuzzer Fuzz Target: zebra Job Type: libfuzzerubsanfrr Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000700a0a Crash State: model Sanitizer: undefined UBSAN Recommended Security...

D-Link DIR-2640 trust management issue vulnerability

D-Link DIR-2640 is a high-powered Wi-Fi router from D-Link, a Taiwan-based company. D-Link DIR-2640 Quagga 1.11B02 and previous versions are vulnerable to a trust management issue, which stems from the use of default hard-coded credentials for the service, and can be exploited by remote attackers...

CVE-2021-20134

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service zebra or ripd. Subsequen...

CVE-2021-20132

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

CVE-2021-20132

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

Hardcoded credentials

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

D-Link DIR-2640 信任管理问题漏洞

D-Link DIR-2640 is a high-powered Wi-Fi router from D-Link, a Taiwan-based company. D-Link DIR-2640 Quagga 1.11B02 and previous versions are vulnerable to a trust management issue, which stems from the use of default hard-coded credentials for the service, and can be exploited by remote attackers...

PT-2021-13789

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2640 versions less than or equal to 1.11B02 Description: The issue allows a remote attacker to gain administrative access to the zebra or ripd services, which are running with root privileges on the router. This is due to the use o...

CVE-2021-20132: Use of Hard-coded Credentials

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

frr:zebra: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=6212789448867840 Project: frr Fuzzing Engine: libFuzzer Fuzz Target: zebra Job Type: libfuzzerubsanfrr Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace Sanitizer: undefined UBSAN...