EUVD-2017-17715

Malware in sbrugna...

Gongjin Electronics BE126 WIFI repeater Arbitrary File Read Vulnerability

Gongjin Electronics BE126 WIFI repeater is a wireless internet repeater from Gongjin Electronics China. A security vulnerability exists in Gongjin Electronics BE126 WIFI repeater version 1.0. The vulnerability can be exploited to read the entire file system with a specially crafted 'getpage'...

Arbitrary file deletion

There is LFD local file disclosure on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage parameter...

Default credentials

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet which is open by default with default credentials as root username:"root" password:"root" and can: 1. Read the entire file system; 2. Write to the file system; or 3. Execute any code that attacker desires malicious or not...

CVE-2017-8770

There is LFD local file disclosure on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage parameter...

PT-2017-18518

Name of the Vulnerable Software and Affected Versions BE126 WIFI repeater version 1.0 Description The issue allows an attacker to log into the device using default credentials as root, with the username: root and password: root, since telnet is open by default. This enables the attacker to read t...

CVE-2017-8771: Use of Hard-coded Credentials

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet which is open by default with default credentials as root username:"root" password:"root". The attacker can make a user that is connected to the repeater click on a malicious link that will log into the telnet and will infect the...

CVE-2017-8770: Exposure of Sensitive Information to an Unauthorized Actor

There is LFD local file disclosure on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage parameter...

CVE-2017-8772: Use of Hard-coded Credentials

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet which is open by default with default credentials as root username:"root" password:"root" and can: 1. Read the entire file system; 2. Write to the file system; or 3. Execute any code that attacker desires malicious or not...

PT-2017-18517

Name of the Vulnerable Software and Affected Versions BE126 WIFI repeater version 1.0 Description The issue allows an attacker to log into the device using default credentials as root, with the username: root and password: root, via telnet, which is open by default. The attacker can then trick a...

PT-2017-18516

Name of the Vulnerable Software and Affected Versions BE126 WIFI repeater version 1.0 Description The issue allows attackers to read the entire filesystem on the device. This is achieved by using a crafted getpage parameter, enabling local file disclosure LFD. Recommendations For BE126 WIFI...