PT-2019-18611

Name of the Vulnerable Software and Affected Versions JioFi 4G M2S version 1.0.2 Description The issue concerns the cgi-bin/qcmap web cgi endpoint on the affected device, where an attacker can exploit XSS and HTML injection vulnerabilities via the mask POST parameter. Recommendations For version...

CVE-2019-7439: Undefined Security Weakness

cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices allows a DoS Hang via the mask POST parameter...

PT-2019-18613

Name of the Vulnerable Software and Affected Versions JioFi 4G M2S version 1.0.2 Description The issue concerns a CSRF vulnerability that can be exploited via the SSID name and Security Key field under Edit Wi-Fi Settings. This is achieved through a SetWiFi Setting request to the "cgi-bin/qcmap w...

CVE-2019-6282

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password...

CVE-2019-6282: Cross-Site Request Forgery (CSRF)

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password...

PT-2019-18069

Name of the Vulnerable Software and Affected Versions ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00 Description The issue is related to an Incorrect Access Control problem. It can be exploited via the "cgi-bin/webproc?getpage=html/index.html&subpage=wlsecurity" URI, allowing a...

PT-2019-18070

Name of the Vulnerable Software and Affected Versions ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00 Description The issue allows an attacker to change the Wireless Security Password due to a CSRF vulnerability via the "cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity...

CVE-2019-6279: Undefined Security Weakness

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulnerability via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password...

PT-2019-18386

Name of the Vulnerable Software and Affected Versions AirTies Air5341 version 1.0.0.12 Description The issue allows for a CSRF attack on the cgi-bin/login endpoint. Recommendations For AirTies Air5341 version 1.0.0.12, consider implementing CSRF protection measures, such as token-based validation...

PT-2019-18591

Name of the Vulnerable Software and Affected Versions Ericsson Active Library Explorer ALEX version 14.3 Description A security issue exists in the software, where an XSS issue is present in multiple parameters of the "/cgi-bin/alexserv" servlet. The affected parameters include DB, FN, fn, and id...

CVE-2019-6967: Cross-Site Request Forgery (CSRF)

AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF...

CVE-2019-7417: Improper Neutralization of Input During Web Page Generation

XSS exists in Ericsson Active Library Explorer ALEX 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id parameter...

Smoothwall Express 3.1-SP4 - Cross-Site Scripting

Exploit Title: Smoothwall Express 3.1-SP4-polar-x8664-update9 | Cross-Site Scripting Date: 06.02.2019 Exploit Author: Ozer Goker Vendor Homepage: http://www.smoothwall.org Software Link: https://sourceforge.net/projects/smoothwall/files/SmoothWall/3.1%20SP4/Express-3.1-SP4-x8664.iso/download...

PLC Wireless Router GPN2.4P21-C-CN Incorrect Access Control

Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Incorrect Access Control Date: 15/01/2019 Exploit Author: Kumar Saurav Vendor: ChinaMobile Category: Hardware Version: GPN2.4P21-C-CN Firmware: W2001EN-00 Tested on: Windows CVE : CVE-2019-6279 Description: ChinaMobile PLC Wireless Router...

PLC Wireless Router GPN2.4P21-C-CN Cross Site Request Forgery

Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Cross-Site Request Forgery CSRF Date: 15/01/2019 Exploit Author: Kumar Saurav Vendor: ChinaMobile Category: Hardware Version: GPN2.4P21-C-CN Firmware: W2001EN-00 Tested on: Windows CVE : CVE-2019-6282 Description: ChinaMobile PLC Wireless Router...

CVE-2018-20326: Improper Neutralization of Input During Web Page Generation

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage=html/index.html var:subpage parameter...

PT-2019-10047

Name of the Vulnerable Software and Affected Versions: ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00 Description: The issue concerns a problem with the cgi-bin/webproc endpoint, specifically the getpage parameter, where the var:subpage parameter is vulnerable. This allows for...

CVE-2018-20576

Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phonetest.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan...

CVE-2018-20577

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...

CVE-2018-20577: Cross-Site Request Forgery (CSRF)

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...