12936 matches found
TOTOLINK A3300R security vulnerabilities
TOTOLINK A3300R is a dual-band wireless router manufactured by China's Gion Electronics TOTOLINK, mainly used for home and small network environments. The TOTOLINK A3300R suffers from a command injection vulnerability that stems from the port and enable parameters of the setRemoteCfg method faili...
CVE-2024-23828
Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of testconfigcmd or startcmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This...
TOTOLINK X2000R Command Injection Vulnerability
TOTOLINK X2000R is a WiFi 6 router from China's Gion Electronics that supports Easy Mesh feature and provides Gigabit internet connection and VPN service. The TOTOLINK X2000R suffers from a command injection vulnerability that stems from the failure of sub449040 in /bin/boa to properly filter...
CVE-2024-23828: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of testconfigcmd or startcmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This...
CVE-2023-38318
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands...
CVE-2023-38319
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands...
CVE-2023-38318
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands...
TOTOLINK A3700R Command Injection Vulnerability
The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3700R is vulnerable to a command injection vulnerability that stems from the setOpModeCfg method failing to properly filter constructed command special characters, commands, and more. An attacker can...
openNDS Security Vulnerabilities
openNDS is openNDS open source a high-performance, small footprint portal system. A security vulnerability exists in openNDS prior to version 10.1.3 that stems from an inability to clean up a network interface name entry in a configuration file, allowing an attacker with direct or indirect access...
OpenNDS Security Vulnerabilities
openNDS is openNDS open source a high performance, small footprint portal system. A security vulnerability exists in OpenNDS prior to version 10.1.3 that stems from an inability to clean up a FAS key entry in a configuration file, allowing an attacker with direct or indirect access to the file to...
openNDS Security Vulnerabilities
openNDS is openNDS open source a high-performance, small footprint portal system. A security vulnerability exists in openNDS prior to version 10.1.3 that stems from an inability to clean up a stateful path script entry in a configuration file, which could allow an attacker with direct or indirect...
TOTOLINK X2000R security vulnerabilities
TOTOLINK X2000R is a WiFi 6 router from China's Gion Electronics that supports Easy Mesh feature and provides Gigabit internet connection and VPN service. The TOTOLINK X2000R suffers from a command injection vulnerability that stems from the failure of sub449040 in /bin/boa to properly filter...
CVE-2023-52040
An issue discovered in TOTOLINK X6000R v9.4.0cu.852B20230719 allows attackers to run arbitrary commands via the sub41284C function...
CVE-2023-52040
An issue discovered in TOTOLINK X6000R v9.4.0cu.852B20230719 allows attackers to run arbitrary commands via the sub41284C function...
CVE-2023-52039
An issue discovered in TOTOLINK X6000R v9.4.0cu.852B20230719 allows attackers to run arbitrary commands via the sub415AA4 function...
Design/Logic Flaw
An issue discovered in TOTOLINK X6000R v9.4.0cu.852B20230719 allows attackers to run arbitrary commands via the sub415C80 function...
CVE-2023-52040
Affected product: TOTOLINK X6000R (v9.4.0cu.852_B20230719). Issue: Command injection via the sub_41284C function, allowing attackers to run arbitrary commands. Root cause / component: Vulnerability in the sub_41284C routine. Impact: Ability to execute arbitrary commands with high impact (per CVE ...
CVE-2023-52039
The CVE-2023-52039 issue affects TOTOLINK X6000R (v9.4.0cu.852_B20230719). A command-injection vulnerability exists in the sub_415AA4 function, enabling an attacker to execute arbitrary commands remotely over the network. The NVD/CNNVD entries confirm a high-severity impact (C/H/I/A = High) with ...
TOTOLINK X2000R Command Injection Vulnerability
TOTOLINK X2000R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK X2000R version 1.0.0-B20221212.1452, which stems from the macstr parameter of the formMapDelDevice function of the /boafrm/formMapDelDevice file failing to correctly...