Design/Logic Flaw

D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer name...

CVE-2020-5525

Aterm series Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen...

Design/Logic Flaw

Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors...

Design/Logic Flaw

Aterm series Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen...

CVE-2020-5534

Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors...

PT-2020-18499

Name of the Vulnerable Software and Affected Versions Aterm WF1200C versions 1.2.1 and earlier Aterm WG1200CR versions 1.2.1 and earlier Aterm WG2600HS versions 1.3.2 and earlier Description The issue allows an attacker on the same network segment to execute arbitrary OS commands with root...

PT-2020-18500

Name of the Vulnerable Software and Affected Versions Aterm WF1200C versions 1.2.1 and earlier Aterm WG1200CR versions 1.2.1 and earlier Aterm WG2600HS versions 1.3.2 and earlier Description The issue allows an authenticated attacker on the same network segment to execute arbitrary OS commands wi...

Design/Logic Flaw

TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the t3.cgi srmodel or srtime parameter...

CVE-2020-8949

Various Gocloud and ISP3000 devices, including S2A_WL 4.2.7.16471 , S2A 4.2.7.17278 , S2A 4.3.0.15815 , S2A 4.3.0.17193 , S3A K2P MTK 4.2.7.16528 , S3A 4.3.0.16572 , and ISP3000 4.3.0.17190 , are vulnerable to an OS command injection vulnerability. The flaw exists due to the improper neutralizati...

CVE-2020-8947

functionsnetflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nfliveview ipdst, dstport, or srcport parameter, a different vulnerability than CVE-2019-20224...

PT-2020-20384

Name of the Vulnerable Software and Affected Versions Netis WF2471 version 1.2.30142 Description The issue allows an authenticated attacker to execute arbitrary OS commands. This is achieved by using shell metacharacters in the log 3g type parameter of the "/cgi-bin-igd/sys log clean.cgi" API...

CVE-2020-8654

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

Command injection

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

CVE-2020-8654

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

CVE-2020-8654

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

PT-2020-20252

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.3 Description An issue allows an authenticated web user with sufficient privileges to abuse the AutoDiscovery module and run arbitrary OS commands via the "module/module frame/index.php autodiscovery.php" target field...

CVE-2020-8438

Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as demonstrated by the nslookuptarget=|cat$IFS substring...

PT-2020-20138

Name of the Vulnerable Software and Affected Versions Ruckus ZoneFlex R500 version 104.0.0.0.1347 Description The issue allows an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form. This can be demonstrated by using the nslookuptarget parameter with...

CVE-2019-19824: Improper Neutralization of Special Elements used in an OS Command

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through...

CVE-2020-7594

MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function...