Default credentials

goform/getProfileList in Orange AirBox Y858FL01.1604 allows attackers to extract APN data name, number, username, and password via the rand parameter...

CVE-2018-18375

goform/getProfileList in Orange AirBox Y858FL01.1604 allows attackers to extract APN data name, number, username, and password via the rand parameter...

CVE-2018-18375

goform/getProfileList in Orange AirBox Y858FL01.1604 allows attackers to extract APN data name, number, username, and password via the rand parameter...

Soldering for Reverse Engineering. Swapping out eSIMs with “normal” SIMs

Sometimes, the mobile devices we work on only have cellular data connections. In those instances, we’re usually pretty interested in trying things like this to get credentials for the APN so we can start snooping around on that. We’re also really interested in monitoring what kind of traffic is...

Trend Micro Champions the AWS Marketplace Channel Opportunity Registration Program

Last year, Trend Micro launched our popular Deep Security as a Service offering on the AWS Marketplace, combining industry-leading threat protection for cloud workloads, effortless deployment, and the added bonus of a unified Amazon Web Services AWS bill. This has been a successful model for...

Malware That Can’t Clean Its Tracks: CCleaner and Ongoing Supply-Chain Attacks

A new malware compromise identified this week was using malware officially signed and provided by its software manufacturer for public download by millions of people. It’s a move that started the week for many organizations in a state of worry. This week, the Cisco Talos research team disclosed...

Cross site scripting

On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" page...

CVE-2017-13724

On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" page...

CVE-2017-13724

CVE-2017-13724 describes a stored Cross-Site Scripting vulnerability in the APN parameter on the Axesstel MU553S MU55XS devices running firmware v1.14, on the Basic Settings page. The affected component is the APN field handling in that page; the root cause is a stored XSS flaw that can persist u...

November 8, 2016 — KB3200970 (OS Build 14393.447)

None None...

November 8, 2016 — KB3198585 (OS Build 10240.17190)

None None...

October 11, 2016 — KB3192440 (OS Build 10240.17146)

None None...

October 11, 2016 — KB3194798 (OS Build 14393.321)

None None...

September 13, 2016 — KB3185614 (OS Build 10586.589)

None None...

Wireshark 1.10.x < 1.10.9 Multiple DoS Vulnerabilities

The installed version of Wireshark is version 1.10.x prior to 1.10.9. It is, therefore, affected by the following vulnerabilities : - A buffer underflow flaw exists in the 'dissectlog' function of the IrDA dissector, which is triggered when handling malformed packets. Using a specially crafted...

CVE-2014-5163

The APN decode functionality in 1 epan/dissectors/packet-gtp.c and 2 epan/dissectors/packet-gsmagm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer, which allows remote attackers to cause a denial of service application...

CVE-2014-5163

The APN decode functionality in 1 epan/dissectors/packet-gtp.c and 2 epan/dissectors/packet-gsmagm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer, which allows remote attackers to cause a denial of service application...

Code injection

The APN decode functionality in 1 epan/dissectors/packet-gtp.c and 2 epan/dissectors/packet-gsmagm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer, which allows remote attackers to cause a denial of service application...

CVE-2014-5163

The APN decode functionality in 1 epan/dissectors/packet-gtp.c and 2 epan/dissectors/packet-gsmagm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer, which allows remote attackers to cause a denial of service application...

CVE-2014-5163

The APN decode functionality in 1 epan/dissectors/packet-gtp.c and 2 epan/dissectors/packet-gsmagm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer, which allows remote attackers to cause a denial of service application...