Novatel MiFi WiFi access point multiple security vulnerabilities

Crossite scripting and crossite response forgery...

Novatel Wireless MiFi 2352 - Password Information Disclosure

Novatel Wireless MiFi 2352 - Password Information Disclosure source: https://www.securityfocus.com/bid/37962/info MiFi 2352 is prone to an information-disclosure vulnerability that may expose sensitive information. Successful exploits will allow authenticated attackers to obtain passwords, which...

Novatel Wireless MiFi 2352 - Password Information Disclosure

source: https://www.securityfocus.com/bid/37962/info MiFi 2352 is prone to an information-disclosure vulnerability that may expose sensitive information. Successful exploits will allow authenticated attackers to obtain passwords, which may aid in further attacks. MiFi 2352 access point firmware...

Trango Broadband Wireless Rogue SU Authentication Bug

-------------------------------------------------------------------------- Trango Broadband Wireless M5830 Series Rogue SU Authentication Bug Date : 15 December, 2009 By: Blair - [email protected] -------------------------------------------------------------------------- Background ----------...

Trango Broadband Wireless Interception

-------------------------------------------------------------------------- Trango Broadband Wireless M5830 Series Rogue SU Authentication Bug Date : 15 December, 2009 By: Blair - [email protected] -------------------------------------------------------------------------- Background ----------...

SNMP Query WLAN SSID (Cisco)

It is possible to obtain the system information about the remote WLAN by sending SNMP requests with the OID 1.3.6.1.4.1.9.9.512.1.1.1.1.4.1 to the remote Access Point controller. An attacker may use this information to gain more knowledge about the target network. TRUSTED...

CVE-2009-0052

The Atheros wireless driver, as used in Netgear WNDAP330 Wi-Fi access point with firmware 2.1.11 and other versions before 3.0.3 on the Atheros AR9160-BC1A chipset, and other products, allows remote authenticated users to cause a denial of service device reboot or hang and possibly execute...

CVE-2009-3836

ArubaOS 3.3.1.x, 3.3.2.x, RN 3.1.x, 3.4.x, and 3.3.2.x-FIPS on the Aruba Mobility Controller allows remote attackers to cause a denial of service Access Point crash via a malformed 802.11 Association Request management frame...

3Com Wireless 8760 access point unauthorized access

During authorized user's session it's possible for another user to access configuration pages without authentication...

Microsoft Windows Wireless LAN AutoConfig service buffer overflow

Buffer overflow on access point frame parsing...

Code injection

Cisco Aironet Lightweight Access Point AP devices send the contents of certain multicast data frames in cleartext, which allows remote attackers to discover Wireless LAN Controller MAC addresses and IP addresses, and AP configuration details, by sniffing the wireless network...

CVE-2009-2861

The Over-the-Air Provisioning OTAP functionality on Cisco Aironet Lightweight Access Point 1100 and 1200 devices does not properly implement access-point association, which allows remote attackers to spoof a controller and cause a denial of service service outage via crafted remote radio manageme...

CVE-2009-2976

Cisco Aironet Lightweight AP devices transmit certain multicast frames in cleartext, enabling remote attackers who sniff the wireless medium to discover Wireless LAN Controller MAC addresses, IP addresses, and AP configuration details. The connected reports reiterate this behavior without providi...

CVE-2009-2861

The Over-the-Air Provisioning OTAP functionality on Cisco Aironet Lightweight Access Point 1100 and 1200 devices does not properly implement access-point association, which allows remote attackers to spoof a controller and cause a denial of service service outage via crafted remote radio manageme...

CVE-2009-2861

Cisco Aironet Lightweight Access Point 1100/1200 OTAP feature has an improper access-point association implementation, enabling remote attackers to spoof a controller and trigger a denial-of-service via crafted remote radio management (RRM) packets. No exploitation details beyond the SkyJack/CSCt...

CVE-2008-6395

The web management interface in 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point allows remote attackers to cause a denial of service device crash via a malformed HTTP POST request...

Cross site request forgery (csrf)

The web management interface in 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point allows remote attackers to cause a denial of service device crash via a malformed HTTP POST request...

CVE-2008-6395

CVE-2008-6395 affects the web management interface of the 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point. A remote attacker can trigger a denial of service (device crash) by sending a malformed HTTP POST request. The available documents identify the affected product and impact but do not ...

Netgear WG102 SNMP Password Leak

Dear all, after informing Netgear about the unsafe handling of passwords on their WG102 Access Points nothing happened for several weeks. To inform other users about the potential threat to their networks I decided to share my findings. WG102 offers the the typical SNMP write & SNMP read communit...

Leak of SNMP write password via SNMP read community in NETGEAR WG102 - Prosafe 802.11g Access Point

Dear all, after informing Netgear about the unsafe handling of passwords on their WG102 Access Points nothing happened for several weeks. To inform other users about the potential threat to their networks I decided to share my findings. WG102 offers the the typical SNMP write & SNMP read communit...