441 matches found
PT-2023-13909 · Siretta · Siretta Quartz-Gold
Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: Several stack-based buffer overflow issues exist in the DetranCLI command parsing functionality. A specially-crafted network packet can lead to arbitrary command execution. An...
CVE-2022-29843 Western Digital My Cloud OS 5 devices Command Injection Vulnerability
A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user...
PT-2023-12988 · Western Digital · Western Digital My Cloud
Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud OS versions prior to 5.26.119 Description: A command injection issue in the DDNS service configuration allows an attacker to execute code as the root user. This issue was demonstrated at Pwn2Own, indicating its...
Western Digital My Cloud Multiple Products 5.x < 5.26.119 Multiple Vulnerabilities (WDC-23002)
Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...
D-Link Routers RCE (CVE-2021-45382)
The remote D-Link router is affected by a vulnerability. A Remote Command Execution RCE vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L,...
CVE-2022-37066
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateDDNS...
Tenda AX1803 缓冲区错误漏洞
Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China. The Tenda AX1803 suffers from a stack overflow vulnerability that is caused by incorrect boundary checking of the formSetSysToolDDNS function. An attacker could exploit this vulnerability would overflow a buffer and execute...
H3C GR-1200W 缓冲区错误漏洞
The H3C GR-1200W is a Gigabit enterprise wireless router from China's Xinhua San H3C. A security vulnerability exists in the H3C GR-1200W MiniGRW1A0V100R006 version, which stems from a stack overflow in the UpdateDDNS method...
CVE-2022-38132
Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL...
Command injection
Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL...
Linksys MR8300 OS Command Injection Vulnerability
Linksys MR8300 is a high-performance tri-band router from Linksys, Inc. The Linksys MR8300 Router version 1.0 contains an operating system command injection vulnerability, which stems from the fact that by specifying a username and password when registering for DDNS services, an attacker could us...
CVE-2022-38132 Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands.
Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL...
CVE-2022-38132
CVE-2022-38132 affects Linksys MR8300 Router v1.0. A command injection vulnerability arises during DDNS registration when attacker-supplied username/password are used in URL construction without proper sanitization, enabling arbitrary OS commands after accessing the router’s web interface. Exploi...
PT-2022-24226 · Linksys · Linksys Mr8300 Router
Name of the Vulnerable Software and Affected Versions: Linksys MR8300 Router version 1.0 Description: A command injection issue exists in the Linksys MR8300 router during the registration process for the DDNS Service. An attacker connected to the router's web interface can execute arbitrary OS...
CISA advises D-Link users to take vulnerable routers offline
On April 4 2022, the Cybersecurity & Infrastructure Security Agency CISA added CVE-2021-45382 to its known exploited vulnerabilities catalog. But since the affected products have reached end of life EOL, the advice is to disconnect them, if still in use. CISA catalog The CISA catalog of known...
D-Link Multiple Routers Remote Code Execution Vulnerability
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file...
CVE-2022-25017
Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field...
Command injection
Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field...
CVE-2022-25017
CVE-2022-25017 affects Hitron CHITA router firmware 7.2.2.0.3b6-CD, with a command-injection vulnerability in the Device/DDNS ddnsUsername field. According to connected sources (CPAI advisory and Red Hat/NVD references), this enables remote code execution via network access, with low privileges r...