CVE-2018-19239

TRENDnet TEW-673GRU router (firmware v1.00b40) contains an OS command injection in the start_arpping function of the timer binary. An attacker can remotely execute commands by crafting a POST to apply.cgi and passing the parameters dhcpd_start, dhcpd_end, and lan_ipaddr. CVE-2018-19239 documents ...

CVE-2018-19242: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in apply.cgi on TRENDnet TEW-632BRP 1.010B32 and TEW-673GRU devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload with authentication...

PT-2018-14889

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-632BRP version 1.010B32 TRENDnet TEW-673GRU affected versions not specified Description The issue is related to a buffer overflow in the apply.cgi file, which can be exploited by crafting a POST request payload with authentication...

CVE-2018-19239: Improper Neutralization of Special Elements used in an OS Command

TRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the startarpping function of the timer binary, which allows remote attackers to execute arbitrary commands via three parameters dhcpdstart, dhcpdend, and lanipaddr passed to the apply.cgi binary through a POST...

PT-2018-14886

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-673GRU version 1.00b40 Description The issue allows remote attackers to execute arbitrary commands on the device. This is achieved by exploiting an OS command injection vulnerability in the start arpping function of the timer...

CVE-2018-3955

An exploitable operating system command injection exists in the Linksys ESeries line of routers Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04. Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulti...

Command injection

An exploitable operating system command injection exists in the Linksys ESeries line of routers Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04. Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulti...

Command injection

Devices in the Linksys ESeries line of routers Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04 are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input...

CVE-2018-3954

Devices in the Linksys ESeries line of routers Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04 are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAMData entered into the 'Router Name' input fiel...

CVE-2018-3953

CVE-2018-3953/3954/3955 affects Linksys E-Series (E1200 v2.0.09; E2500 v3.0.04). Root cause: OS command injection via nvram_get/nvram_set path triggered after data from the web portal’s Router Name, written to NVRAM and then executed in preinit/start_lltd, affecting hostname and related domain na...

CVE-2018-3955

An exploitable operating system command injection exists in the Linksys ESeries line of routers Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04. Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulti...

CVE-2018-3954: Improper Neutralization of Special Elements used in an OS Command

Devices in the Linksys ESeries line of routers Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04 are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAMData entered into the 'Router Name' input fiel...

Linksys ESeries multiple OS command injection vulnerabilities

Summary Multiple exploitable operating system command injections exist in the Linksys ESeries line of routers. Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send an...

CVE-2018-18291

A cross site scripting XSS vulnerability on ASUS RT-AC58U 3.0.0.4.3806516 devices allows remote attackers to inject arbitrary web script or HTML via AdvancedASUSDDNSContent.asp, AdvancedWSecurityContent.asp, AdvancedWirelessContent.asp, Logout.asp, MainLogin.asp, MobileQISLogin.asp, QISwizard.htm...

CVE-2016-6558

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the actionscript parameter. The actionscript parameter specifies a script to be executed if the actionmode parameter does not conta...

Command injection

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the actionscript parameter. The actionscript parameter specifies a script to be executed if the actionmode parameter does not conta...

CVE-2016-6558

CVE-2016-6558 describes a command injection in the ASUS RP-AC52 web interface via apply.cgi, specifically in the action_script parameter. If action_script does not match a hard-coded option, input is passed to system() or eval(), enabling arbitrary commands. Affected firmware is 1.0.1.1s and poss...

VulnCheck KEV: CVE-2013-2679

Multiple cross-site scripting XSS vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inject arbitrary web script or HTML via the 1 logtype, 2 pingip, 3 pingsize, 4 submittype, or 5 tracerouteip parameter to apply.cgi or 6 newworkgroup or 7...

VulnCheck KEV: CVE-2013-2678

Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or execute arbitrary code by sending a crafted URL request to the apply.cgi script using the submittype parameter...

CVE-2016-6558: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the actionscript parameter. The actionscript parameter specifies a script to be executed if the actionmode parameter does not conta...