CVE-2019-11319: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function downloadFirmware in hnap, which leads to remote code execution via shell metacharacters in a JSON value...

PT-2019-12235

Name of the Vulnerable Software and Affected Versions Motorola CX2 version 1.01 Motorola M2 version 1.01 Description A command injection issue in the downloadFirmware function within the hnap module allows for remote code execution. This is achieved by using shell metacharacters in a JSON value...

CVE-2018-12031: Improper Limitation of a Pathname to a Restricted Directory

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/nodeupgradesrv.js directory traversal with the firmware parameter in a downloadFirmware action...

PT-2018-10954

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager version 1.6 Description The issue allows an attacker to perform a local file inclusion via directory traversal in the server/node upgrade srv.js. This is achieved by manipulating the firmware parameter in a...