CVE-2017-16563

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

CVE-2017-16563

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

CVE-2017-16564: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in /cgi-bin/config2 on Vonage Grandstream HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field P148...

CVE-2017-16563: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

CVE-2017-16565: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in /cgi-bin/login on Vonage Grandstream HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests...

PT-2017-14449

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description A stored Cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field,...

PT-2017-14448

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the Basic Settings screen. This allows attackers to modify settings related to the cgi-bin/update endpoint...

PT-2017-14450

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the /cgi-bin/login API endpoint. This allows attackers to authenticate a user via the login screen using the...

CVE-2017-15647: Improper Limitation of a Pathname to a Restricted Directory

On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value...

PT-2017-14139

Name of the Vulnerable Software and Affected Versions FiberHome routers affected versions not specified Description A Directory Traversal issue exists in the /cgi-bin/webproc endpoint via the getpage parameter in conjunction with a crafted var:page value. Recommendations At the moment, there is n...

FiberHome Directory Traversal

Vulnerability Summary The following advisory describes a directory traversal vulnerability found in FiberHome routers. FiberHome Technologies Group “was established in 1974. After continuous and intensive development for over 40 years, its business has been extended to R&D, manufacturing, marketi...

CVE-2017-14942: Files or Directories Accessible to External Parties

Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie...

CVE-2017-11350

Cross-Site Request Forgery CSRF exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices...

CVE-2017-11350: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices...

PT-2017-11951

Name of the Vulnerable Software and Affected Versions Axesstel MU553S MU55XS-V1.14 Description A Cross-Site Request Forgery CSRF issue exists in the cgi-bin/ConfigSet endpoint. This allows for potential unauthorized actions on affected devices. Recommendations For Axesstel MU553S MU55XS-V1.14,...

CVE-2017-14262: Inadequate Encryption Strength

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

PT-2017-13331

Name of the Vulnerable Software and Affected Versions Samsung NVR devices affected versions not specified Description The issue allows remote attackers to read the MD5 password hash of the 'admin' account by sending certain szUserName JSON data to the "cgi-bin/main-cgi" API endpoint. This hash ca...

PT-2017-13039

Name of the Vulnerable Software and Affected Versions T&W WIFI Repeater BE126 version not specified Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to "cgi-bin/webupg". Recommendations For T&W WIFI Repeater BE126,...

PT-2017-13090

Name of the Vulnerable Software and Affected Versions Lexmark Scan To Network SNF versions 3.2.9 and earlier Description The issue allows remote attackers to obtain sensitive information. This is due to network configuration credentials being stored in plaintext and transmitted in requests...

CVE-2017-13713: Improper Neutralization of Special Elements used in an OS Command

T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg...