CVE-2017-16934

The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a changepassword.csp request, which supports a...

Design/Logic Flaw

The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a changepassword.csp request, which supports a...

CVE-2017-16934

The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a changepassword.csp request, which supports a...

CVE-2017-16934

CVE-2017-16934 affects the web server in DBL DBLTek devices. An attacker can obtain the admin password via a frame.html?content=/dev/mtdblock/5 request and use it for HTTP Basic Auth to reach change_password.csp, where the passwd parameter supports a

DBL DBLTek Device Web Server Command Execution Vulnerability

DBL DBLTek devices is a gateway product from DBL China. web server is one of the web servers. A security vulnerability exists in the web server on DBL DBLTek devices. The vulnerability can be exploited by a remote attacker to execute arbitrary operating system commands by obtaining the...