Metasploit Weekly Wrap-Up

Nagios XI web shell upload module New this week is a Nagios Web Shell Upload module from Rapid7' own Jake Baines, which exploits CVE-2021-37343. This module builds upon the existing Nagios XI scanner written by Erik Wynter. Versions of Nagios XI prior to 5.8.5 are vulnerable to a path traversal...

CVE-2020-5723

creationtimestamp| type| source ---|---|--- 2022-02-15 17:41:31+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/grandstreamucm62xxsqlaccountguess.rb 2024-10-18 16:52:06+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/881...

CVE-2020-5723

The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges...

CVE-2020-5723

CVE-2020-5723 affects Grandstream UCM62xx/UCM6200 series (firmware 1.0.20.22 and earlier). Root cause: unencrypted user passwords stored in an SQLite database, enabling an attacker to retrieve passwords and potentially gain elevated privileges. Connected documents also reference related CVE-2020-...