CVE-2023-43492

Weintek cMT3000 HMI Web CGI (cgi-bin codesys.cgi) is affected by a stack-based buffer overflow vulnerability (CVE-2023-43492). The issue could allow an unauthenticated attacker to hijack control flow and bypass login authentication. Impact is rated critical (CVSS v3.1 base score 9.8) with network...

CVE-2023-43492 Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication...

CVE-2023-40145 Weintek cMT3000 HMI Web CGI OS Command Injection

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device...

CVE-2023-40145

CVE-2023-40145 is an OS Command Injection in Weintek cMT3000 HMI Web CGI (cgi-bin area). The vulnerability allows an anonymous attacker, after login, to execute arbitrary commands on affected devices. The issue is classified under CWE-78 (OS Command Injection) and is part of a pair of flaws affec...

CVE-2023-38584 Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin commandwb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication...

CVE-2023-38584

CVE-2023-38584 affects Weintek cMT3000 HMI Web CGI: the stack-based buffer overflow in cgi-bin command_wb.cgi can allow an anonymous network attacker to hijack control flow and bypass login authentication (CRITICAL, CVSS v3.1 9.8). Affected products include cMT3000 family variants; root cause is ...

The vulnerability of the gwcfg_cgi_set_manage_post_data() function in the microprogramming software for industrial Wi-Fi routers Yifan YF325 allows a hacker to influence the integrity, accessibility, and confidentiality of the protected information.

The vulnerability of the gwcfgcgisetmanagepostdata function in the microprogramming-based industrial Wi-Fi routers from Yifan YF325 relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to influence the integrity, availability,...

Weintek cMT Buffer Error Vulnerability

Weintek cMT is a human machine interface application from Weintek. A security vulnerability exists in the Weintek cMT3000 HMI Web CGI, which stems from the fact that cgi-bin commandwb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and...

Weintek cMT Buffer Error Vulnerability

Weintek cMT is a human machine interface application from Weintek. A security vulnerability exists in the Weintek cMT3000 HMI Web CGI, which stems from the fact that cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypa...

Weintek cMT3000 HMI Web CGI

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Weintek Equipment : cMT3000 CMI Web CGI Vulnerabilities : Stack-based Buffer Overflow, OS Command Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...

CVE-2023-44961

SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. component...

CVE-2023-35968

Two heap-based buffer overflow vulnerabilities exist in the gwcfgcgisetmanagepostdata functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger these vulnerabilities.This integer overflow...

CVE-2023-35055

A buffer overflow vulnerability exists in the httpd nextpage functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.This buffer overflow is in the nextpage parameter in the...

CVE-2023-35056

A buffer overflow vulnerability exists in the httpd nextpage functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.This buffer overflow is in the nextpage parameter in the...

Buffer overflow

A buffer overflow vulnerability exists in the httpd nextpage functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.This buffer overflow is in the nextpage parameter in the...

CVE-2023-35194

An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 in QEMU. A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerabilit...

CVE-2023-35056

A buffer overflow vulnerability exists in the httpd nextpage functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.This buffer overflow is in the nextpage parameter in the...

Yifan YF325 Buffer Error Vulnerability

Yifan YF325 is a wireless router from Yifan. A buffer error vulnerability exists in Yifan YF325 v1.020221108, which stems from a buffer overflow vulnerability in the gwcfgcgisetmanagepostdata function...

PT-2023-6258 · Yifan · Yifan Yf325

Name of the Vulnerable Software and Affected Versions: Yifan YF325 version 1.0 20221108 Description: A buffer overflow vulnerability exists in the httpd next page functionality, allowing an attacker to execute arbitrary commands by sending a specially crafted network request. The buffer overflow ...

Command injection

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /cgi-bin/login.cgi endpoint. This is due to...