2465 matches found
Huawei UPnP DeviceUpgrade command injection
Added: 01/02/2018 BID: 102344 Background Huawei home routers support the DeviceUpgrade service type over the Universal Plug and Play UPnP protocol to facilitate upgrading of firmware. Problem A remote authenticated attacker can execute arbitrary commands injected into the NewStatusURL XML element...
Huawei UPnP DeviceUpgrade command injection
Added: 01/02/2018 BID: 102344 Background Huawei home routers support the DeviceUpgrade service type over the Universal Plug and Play UPnP protocol to facilitate upgrading of firmware. Problem A remote authenticated attacker can execute arbitrary commands injected into the NewStatusURL XML element...
Default Password and Remote Command Execution Vulnerabilities in ANYSEC Security Gateway by ZTE NetWizard
The ANYSEC-M6100 is a standard 1U rack mount VPN security access gateway. Default password and remote command execution vulnerabilities exist in the ANYSEC security gateway of ZKNETWAY, which allow attackers to log in to the backend, construct specific code, remotely execute commands, write...
CVE-2017-17878
An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...
CVE-2017-17878
An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...
Moxa NPort W2150A and W2250A Unauthorized Access Vulnerability
Moxa NPort W2150A and NPort W2250A are Moxa's serial communication servers for connecting industrial serial devices to a network. An unauthorized access vulnerability exists in the Moxa NPort W2150A prior to version 1.11 and the NPort W2250A prior to version 1.11, which stems from a null default...
CVE-2017-16727
A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is empty on the device. An unauthorized user can access the device without a password. An unauthorized user has the ability to completely...
Default credentials
A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is empty on the device. An unauthorized user can access the device without a password. An unauthorized user has the ability to completely...
CVE-2017-16727
A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is empty on the device. An unauthorized user can access the device without a password. An unauthorized user has the ability to completely...
Default Password 'cat1029' for 'Wproot' Account
The account 'Wproot' on the remote host has the default password 'cat1029'. A remote attacker can exploit this issue to gain administrative access to the affected system. Note that this username / password combination was found in the leaked source from the Mirai botnet. %NASLMINLEVEL 70300 C...
Default Password 'QwestM0dem' for 'admin' Account
The account 'admin' on the remote host has the default password 'QwestM0dem'. A remote attacker can exploit this issue to gain administrative access to the affected system. Note that this username / password combination was found in the leaked source from the Mirai botnet. %NASLMINLEVEL 70300 C...
The vulnerability of Zyxel Wi-Fi transponders lies in the use of pre-set credentials, which allows attackers to intercept DNS requests.
The vulnerability of the Zyxel Wi-Fi signal relay stems from the use of pre-set account credentials “root” and “admin” default password: 1234 during Telnet protocol connections. Exploiting this vulnerability allows a remote attacker to intercept DNS requests by reconfiguring the built-in...
CVE-2017-16565
Cross-Site Request Forgery CSRF in /cgi-bin/login on Vonage Grandstream HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF in /cgi-bin/login on Vonage Grandstream HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests...
CVE-2017-16565
Cross-Site Request Forgery CSRF in /cgi-bin/login on Vonage Grandstream HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests...
CVE-2017-16565
CVE-2017-16565 describes a CSRF vulnerability in the Vonage (Grandstream) HT802 home gateway. An attacker can abuse CSRF on the /cgi-bin/login page to authenticate a user by using the device’s default password (123) and submit arbitrary requests. Public sources corroborate that this affects HT802...
CVE-2017-16565
Cross-Site Request Forgery CSRF in /cgi-bin/login on Vonage Grandstream HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests...
CVE-2017-15366
Before Thornberry NDoc version 8.0, laptop clients and the server have default database Cache users set up with a single password. This password is left behind in a cleartext log file during client installation on laptops. This password can be used to gain full admin/system access to client devic...
CVE-2017-15366
Thornberry NDoc before version 8.0 stores default Cache database credentials with a single password that is written to a plaintext log during laptop client installation. If an attacker obtains this password (even without local access), they can gain full admin/system access to the affected client...