Cross site scripting

Cross-site scripting XSS vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Information disclosure

eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL...

CVE-2015-7926

eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot...

Design/Logic Flaw

eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2015-7926

eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL...

CVE-2015-7929

eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

CVE-2015-7924

eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2015-7925

Cross-site request forgery CSRF vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot...

CVE-2015-7925

CVE-2015-7925 is a CSRF vulnerability affecting eWON industrial routers with firmware prior to 10.1s0. The web server allows actions to be triggered without anti-CSRF protections, enabling an attacker to perform administrator-level operations (e.g., firmware upload, configuration changes, reboot)...

CVE-2015-7927

CVE-2015-7927 is a stored cross-site scripting (XSS) vulnerability in eWON industrial routers running firmware up to 10.1s0. The issue enables remote attackers to inject arbitrary web script or HTML via unspecified vectors in the device’s web interface. Affected product line is eWON routers; firm...

CVE-2015-7929

CVE-2015-7929 affects eWON industrial routers with firmware up to and including 10.1s0. The issue arises from handling of GET requests, allowing remote attackers to read sensitive data such as web-server access logs, Referer logs, or browser history. Exploitation could be performed remotely due t...

CVE-2015-7926

CVE-2015-7926 concerns eWON industrial routers. Affected: firmware versions prior to 10.1s0. Root cause: RBAC for I/O server information and status requests is omitted, permitting an unauthenticated, remote attacker to obtain sensitive information via an unspecified URL. Impact, as stated: inform...

CVE-2015-7927

Cross-site scripting XSS vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-7928

CVE-2015-7928 affects eWON devices with firmware versions earlier than 10.1s0. The root cause is a missing autocomplete attribute (off) for a password field in the web UI, enabling an attacker to potentially obtain access from an unattended workstation. The vulnerability is classified as remote-e...

CVE-2015-7924

CVE-2015-7924 affects eWON industrial routers with firmware versions prior to 10.1s0. The root cause is weak session management: the software retains the user session in the browser after a log-off action, allowing a logged-in user’s session to persist on an unattended workstation. The vulnerabil...

CVE-2015-7928

eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

eWON Cross-Site Scripting Vulnerability

eWON is an industrial router product from eWON Belgium. A cross-site scripting vulnerability exists in eWON using firmware versions prior to 10.1s0. An attacker can exploit this vulnerability to execute arbitrary script or HTML code on a web server or application...

eWON Unauthorized Access Vulnerability

eWON is an industrial router product from eWON Belgium. A security vulnerability exists in eWON using firmware versions prior to 10.1s0. The vulnerability can be exploited by an attacker with the help of a spoofed URL to obtain information and the status of the I/O server...

eWON Cross-Site Request Forgery Vulnerability

eWON is an industrial router product from eWON Belgium. A cross-site request forgery vulnerability exists in eWON using firmware versions prior to 10.1s0. An attacker could exploit this vulnerability to perform unauthorized operations with user privileges...