18080 matches found
CVE-2024-51259
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setupcacertificate function...
CVE-2024-51254
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the signcacertificate function...
Tenda AC7 ate_ifconfig_set function command injection vulnerability
Tenda AC7 is a wireless router from Tenda, a Chinese company. The Tenda AC7 suffers from a command injection vulnerability that stems from ateifconfigset failing to properly filter construct command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary command...
CVE-2024-51259
CVE-2024-51259 affects DrayTek Vigor3900, version 1.5.1.3. The issue is a command-injection flaw in the CGI endpoint, allowing an attacker to inject commands into the mainfunction.cgi via the setup_cacertificate function, enabling arbitrary commands execution. The vulnerability carries a high imp...
Tenda AC7 ate_iwpriv_set function command injection vulnerability
Tenda AC7 is a wireless router from Tenda, a Chinese company. The Tenda AC7 suffers from a command injection vulnerability that stems from ateiwprivset failing to correctly filter construct command special characters, commands, and so on. An attacker can exploit this vulnerability to execute...
CVE-2024-51255
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequestcertificate function...
CVE-2024-51258
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function...
CVE-2024-51257
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function...
CVE-2024-51300
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the getrrd function...
CVE-2024-51298
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function...
CVE-2024-51296
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function...
CVE-2024-51299
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function...
CVE-2024-51296
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function...
CVE-2024-51257
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function...
CVE-2024-51296
CVE-2024-51296 affects DrayTek Vigor3900, version 1.5.1.3. The vulnerability stems from the ability to inject malicious commands into the web endpoint mainfunction.cgi and execute arbitrary commands by invoking the pingtrace function. The described impact is arbitrary command execution with high ...
CVE-2024-51258
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function...
CVE-2024-51300
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the getrrd function...
CVE-2024-51257
Vulnerable product: DrayTek Vigor3900 firmware 1.5.1.3. Issue: mainfunction.cgi accepts input via doCertificate, enabling attackers to inject commands and achieve arbitrary command execution. Root cause: insecure handling in the doCertificate path leading to remote code execution. Impact: high-se...