CVE-2024-31972

EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execution under the context of the user's session via the Wi-Fi SSID input fields. Web scripts embedded into the vulnerable fields this way are executed immediate...

CVE-2024-31975

EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vulnerable field is executed when the user clicks the SSID field's corresponding EDIT button...

CVE-2024-31972

EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execution under the context of the user's session via the Wi-Fi SSID input fields. Web scripts embedded into the vulnerable fields this way are executed immediate...

CVE-2024-31973

Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'Network Name SSID' input fields to the /index.htmlwirelessbasic page...

CVE-2024-31975

EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vulnerable field is executed when the user clicks the SSID field's corresponding EDIT button...

CVE-2024-31972

EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execution under the context of the user's session via the Wi-Fi SSID input fields. Web scripts embedded into the vulnerable fields this way are executed immediate...

CVE-2024-31975

CVE-2024-31975 affects EnGenius EWS356-Fit (and ESR580) up to version 1.1.30, where a stored XSS is possible via Wi-Fi SSID parameters. The attack relies on the user interacting with the SSID EDIT button to trigger JavaScript execution. Root cause: UI/input handling in SSID parameter parsing allo...

CVE-2024-31973

Hitron CODA-4582 2AHKM-CODA4589 devices (firmware version 7.2.4.5.1b8) are affected by CVE-2024-31973, a stored XSS vulnerability in the SSID field of the /index.html#wireless_basic page. The issue allows a remote attacker within Wi‑Fi proximity to inject script via the Network Name (SSID) input,...

CVE-2024-31973

Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'Network Name SSID' input fields to the /index.htmlwirelessbasic page...

CVE-2024-31972

CVE-2024-31972 affects EnGenius ESR580 A8J-EMR5000 devices, enabling a remote attacker to perform stored XSS via the Wi‑Fi SSID input fields. The vulnerability leads to arbitrary JavaScript execution within the user’s admin session when loading the login page, specifically impacting the endpoints...

Researchers Discover Command Injection Flaw in Wi-Fi Alliance's Test Suite

A security flaw impacting the Wi-Fi Test Suite could enable unauthenticated local attackers to execute arbitrary code with elevated privileges. The CERT Coordination Center CERT/CC said the susceptible code from the Wi-Fi Alliance has been found deployed on Arcadyan FMIMG51AX000J routers. The...

CVE-2024-9991

This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the...

CVE-2024-9991 Cleartext Storage of Sensitive Information Vulnerability in Philips Lighting Devices

This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the...

CVE-2024-9991 Cleartext Storage of Sensitive Information Vulnerability in Philips Lighting Devices

This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the...

CVE-2024-9991

CVE-2024-9991 affects Philips lighting devices (smart Wi‑Fi LEDs). The root cause is storage of Wi‑Fi credentials in plain text within device firmware, enabling an attacker with physical access to extract the firmware and obtain plaintext credentials. This could allow unauthorized access to the W...

CVE-2024-45242

EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2c1.9.51 allow blind OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credential...

CVE-2024-45242

EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2c1.9.51 allow blind OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credential...

CVE-2024-45242

EnGenius ENH1350EXT A8J-ENH1350EXT devices up to 3.9.3.2_c1.9.51 are affected by a blind OS command injection via shell metacharacters in the Ping/Speed Test utilities. A window during initial setup creates an open unsecured network with default admin/admin credentials, allowing a nearby attacker...

Vulnerable WiFi Alliance example code found in Arcadyan FMIMG51AX000J

Overview A command injection vulnerability has been identified in the Wi-Fi Test Suite, a tool developed by the WiFi Alliance, which has been found deployed on Arcadyan routers. This flaw allows an unauthenticated local attacker to exploit the Wi-Fi Test Suite by sending specially crafted packets...

D-Link DIR-619L B1 Buffer Overflow Vulnerability

The DIR-619L B1 is a home network router that provides high-speed Wi-Fi connectivity, is easy to set up and has multiple ports. A buffer overflow vulnerability exists in the D-Link DIR-619L B1. An attacker could use this vulnerability to modify the state of the program, such as by overwriting the...