PT-2015-7671

Name of the Vulnerable Software and Affected Versions eWON devices versions prior to 10.1s0 Description The issue allows remote attackers to obtain access by leveraging an unattended workstation, due to the failure of the device to discard browser session data after a log-off action...

PT-2015-7676

Name of the Vulnerable Software and Affected Versions eWON devices with firmware through 10.1s0 Description The issue allows remote attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, due to the support of unspecified GET...

PT-2015-7675

Name of the Vulnerable Software and Affected Versions eWON devices versions prior to 10.1s0 Description The issue makes it easier for remote attackers to obtain access by leveraging an unattended workstation, as the password field does not have an off autocomplete attribute. Recommendations For...

PT-2015-7673

Name of the Vulnerable Software and Affected Versions eWON devices versions prior to 10.1s0 Description The issue allows remote attackers to obtain sensitive information. This is due to the omission of Role-Based Access Control RBAC for I/O server information and status requests in affected...

PT-2015-7674

Name of the Vulnerable Software and Affected Versions eWON devices with firmware through 10.1s0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For eWON devices with firmware through 10.1s0, updat...

CVE-2015-7927: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-7929: Exposure of Sensitive Information to an Unauthorized Actor

eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

CVE-2015-7926: Exposure of Sensitive Information to an Unauthorized Actor

eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL...

CVE-2015-7924: Undefined Security Weakness

eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2015-7925: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot...

eWON Vulnerabilities

OVERVIEW Independent researcher Karn Ganeshen has identified several vulnerabilities in the eWON sa industrial router. eWON sa has produced an updated firmware to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following eWON router firmwar...

Bash Command Injection Vulnerability (Supplement)

OVERVIEW This advisory supplement is to accompany the NCCIC/ICS-CERT advisory titled ICSA-14-269-01 Bash Command Injection Vulnerability and all following updates that were originally published September 26, 2014, on the ICS-CERT web site and posted to the US-CERT secure Portal library. Please...