CVE-2020-37153

ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with...

CVE-2020-37153 ASTPP VoIP 4.0.1 - Remote Code Execution

ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with...

CVE-2020-37153 ASTPP VoIP 4.0.1 - Remote Code Execution

ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with...

CVE-2025-65127

A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access administrative information-retrieval functions intended for authenticated users. By invoking "get" operations, attackers can obtain device...

PT-2026-7669

ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with...

ASTPP 跨站脚本漏洞

ASTPP is a VoIP billing solution developed by Innextrix Technologies Pvt. Ltd. Version 4.0.1 of ASTPP contains a cross-site scripting vulnerability. This vulnerability stems from cross-site scripting and command injection vulnerabilities in the SIP device configuration and plugin management...

CVE-2020-37097 Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)

Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencryptwiz.asp file. Attackers can access the script to retrieve sensitive information including WiFi network name and plaintext password stored in device...

CVE-2022-50975 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configuration

An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configuration via ethernet is enabled...

CVE-2022-50975

CVE-2022-50975 affects multiple Innomic VibroLine VLX and avibia AVLX devices. Description: an unauthenticated attacker can reuse a valid session ID from a logged-in user to gain full device access when ethernet configuration is enabled. Connected sources (Red Hat, NVD, CVE List, Attackerkb, EUVD...

PT-2026-3270

Name of the Vulnerable Software and Affected Versions TP-Link VIGI Cameras affected versions not specified Description An authentication bypass issue exists in the password recovery feature of the local web interface of TP-Link VIGI cameras. This allows an attacker on the Local Area Network LAN t...

CVE-2025-47855

An exposure of sensitive information to an unauthorized actor CWE-200 vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests...

CVE-2025-47855

CVE-2025-47855 affects Fortinet FortiFone: versions 3.0.13–3.0.23 and 7.0.0–7.0.1 are vulnerable to an unauthenticated information disclosure via crafted HTTP/HTTPS requests (CWE-200). The vulnerability allows retrieval of device configuration. Remediation stated in sources: upgrade to FortiFone ...

Fortinet FortiFone 信息泄露漏洞

Fortinet FortiFone is a series of IP phones from Fortinet, Inc. An information disclosure vulnerability exists in Fortinet FortiFone versions 7.0.0 through 7.0.1 and 3.0.13 through 3.0.23, which stems from a specially crafted HTTP or HTTPS request that can lead to the disclosure of the device...

CVE-2005-1578

EnCase Forensic Edition 4.18a does not support Device Configuration Overlays DCO, which allows attackers to hide information without detection...

CVE-2010-0548

Multiple unspecified vulnerabilities in the Network Controller and Web Server in Xerox WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, and 5687 allow remote attackers to 1 access mailboxes via unknown vectors that bypass Scan to Mailbox authorization or 2 read device configuration information via...

CVE-2025-64091 Authenticated Remote Code Execution in the NTP-configuration

This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device...

CVE-2020-7589

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions. The vulnerability could lead to an attacker reading and modifying the device configuration and obtain project files from affected devices. The security vulnerability could be exploited by an unauthenticated...

CVE-2020-12266

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed...

CVE-2024-39278

Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow read-only access to network configuration information and terminal configuration data...

Zenitel ICX500和Zenitel ICX510 安全漏洞

The Zenitel ICX500 and Zenitel ICX510 are both communication and control platforms from Zenitel Norway. A security vulnerability exists in the Zenitel ICX500 and Zenitel ICX510 that originates from an authenticated attacker being able to execute commands via the device's NTP configuration...