CVE-2021-3166

Asus DSL-N14UB1 v.1.1.2.3805에서 문제가 발견되었습니다. 공격자는 파일이 SettingsProductName.trx예: SettingsDSL-N14U-B1.trx로 이름이 변경되기만 하면 어떤 파일이든 펌웨어 상자에 업로드할 수 있습니다. 파일이 로드되면 실제 업데이트인 것처럼 광범위한 서비스에서 종료 조치가 트리거되어 DoS 상태가 발생합니다...

CVE-2024-42642

CVE-2024-42642 소개 해당 디바이스는 모든 MX500 시리즈 SSD입니다. 이 SSD는 Sillicon-Motion SM2259 컨트롤러로 제어됩니다 이전 배치에서는 이전 컨트롤러인 Sillicon-Motion SM2258을 사용했지만, 이 문서의 주요 초점은 새로운 컨트롤러입니다. SM2259는 ARC 아키텍처 기반의 32비트 리틀 엔디언 CPU를 탑재한 4채널 SATA 6Gb/s 마이크로컨트롤러입니다. 이 문서 작성 시점의 최신 펌웨어인 M3CR046을 관찰한 결과, 정적 및 동적으로 몇 가지 문제가 확인되고...

CVE-2023-33768

CVE-2023-33768 설명 Belkin Wemo Smart Plug WSP080 v1.2의 장치 펌웨어 업데이트 과정에서 펌웨어 서명 검증이 올바르게 이루어지지 않아, 공격자가 조작된 펌웨어 파일을 통해 서비스 거부DoS를 유발할 수 있습니다. 추가 정보 모바일 애플리케이션을 통해 Wemo 스마트 플러그의 펌웨어를 업데이트할 때, 스마트 플러그 펌웨어 바이너리의 펌웨어 서명이 유효하지 않으면 Wemo 스마트 플러그가 응답을 멈추고벽돌 상태가 됨 동작하지 않게 되는 것을 발견했습니다. Wemo Android...

Tenda Router AC11 - Remote Command Injection

Tenda Router AC11 is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-31755 info: name: Tenda Router AC11 - Remote Comman...

Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass

Zyxel NBG2105 V1.00AAGU.2C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access. id: CVE-2021-3297 info: name: Zyxel NBG2105 V1.00AAGU.2C0 - Authentication Bypass author: gy741 severity: high description: Zyxel NBG21...

TOTOLink - Unauthenticated Command Injection

TOTOLink A950RG V5.9c.4050B20190424 and V4.1.2cu.5204B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter. id: CVE-2022-25082 info: name: TOTOLink -...

Mitel 6000 - OS Command Injection

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 R6.4.0.4006, and the 6970 Conference Unit through 6.4 SP4 R6.4.0.4006 or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient paramete...

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

WAVLINK WN535 G3 - Information Disclosure

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to information disclosure in livecheck.shtml. An attacker can obtain sensitive router information via execution of the exec cmd function and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized...

NETGEAR - Authentication Bypass

NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations. id:...

Lexmark Printers - Command Injection

Certain Lexmark devices through 2023-02-19 mishandle Input Validation issue 1 of 4. id: CVE-2023-26067 info: name: Lexmark Printers - Command Injection author: DhiyaneshDK severity: high description: | Certain Lexmark devices through 2023-02-19 mishandle Input Validation issue 1 of 4. impact: |...

HP Switch - Authentication Bypass

A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in...

Wavlink WN-535G3 - Cross-Site Scripting

Wavlink WN-535G3 contains a POST cross-site scripting vulnerability via the hostname parameter at /cgi-bin/login.cgi. id: CVE-2022-30489 info: name: Wavlink WN-535G3 - Cross-Site Scripting author: For3stCo1d severity: medium description: | Wavlink WN-535G3 contains a POST cross-site scripting...

WAVLINK WN535 G3 - Information Disclosure

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to information disclosure in the livemfg.shtml page. An attacker can obtain sensitive router information via the exec cmd function and possibly obtain additional sensitive information, modify data, and/or execute unauthorized operations. id:...

Sercomm VD625 Smart Modems - CRLF Injection

Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT2.1.0 are vulnerable to Carriage Return Line Feed CRLF injection via the Content-Disposition header. id: CVE-2021-27132 info: name: Sercomm VD625 Smart Modems - CRLF Injection author: geeknik severity: critical description: Sercomm...

WAVLINK WN535 G3 - Improper Access Control

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...

WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure

WAVLINK WN579 X3 M79X3.V5030.180719 is susceptible to information disclosure in /cgi-bin/ExportAllSettings.sh. An attacker can obtain sensitive router information via a crafted POST request and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized...

ASUS DSL-AC88U - Authentication Bypass

A vulnerability in the ASUS DSL-AC88U router permits unauthorized individuals to bypass authentication.When adding "/js/..%2f%2f" or "/images/..%2f%2e" to the requested URL, it will be recognized as passing the authentication.This vulnerability is part of a broader authentication bypass issue...

flipperzero-firmware

Flipper Zero ファームウェア Flipper Zero 公式ウェブサイト - Flipper Zero ができることを友達に簡単に説明できる方法。 Flipper Zero ファームウェアアップデート - あなたのイルカのための改良: 最新のファームウェアリリース、PC およびモバイルデバイス用のアップグレードツール。 ユーザードキュメント - あなたのイルカについてもっと学ぶ: 仕様、使用ガイド、そして知りたいことすべて。 開発者向けドキュメント - Flipper Zero ファームウェアのソースコードを深く掘り下げる: ビルドシステム、ファームウェア構造など。...

CVE-2026-86326

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...