Netgear RP614v3 Authentication Bypass

Vendor : NETGEAR Product : RP614v3 informed on : 12. 10. 2015 responded : no fixed : no Effect : Remotely exploitable over LAN/WLAN Typ : Authentication Bypass Difficulty : trivial The N300 FW authentication bypass inspired me to check my rp614v3 router and I found this bypass: Firmware:...

D-Link DSL-2750B OS Command Injection

This module exploits a remote command injection vulnerability in D-Link DSL-2750B devices. Vulnerability can be exploited through "cli" parameter that is directly used to invoke "ayecli" binary. Vulnerable firmwares are from 1.01 up to 1.03. Module Options msf use...

GE Industrial Solutions UPS SNMP Adapter < 4.8 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Storage of Sensitive Information Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.geindustrial.com/ Versions Reported: All...

Netgear 1.0.0.24 Cross Site Request Forgery

Details ================ Product Vendor: Netgear Netgear GPL: http://kb.netgear.com/app/answers/detail/aid/2649//netgear-open-source-code-for-programmers-gpl http://www.gnu.org/licenses/gpl.txt Bug Name: Cross Site Request Forgery in Netgear Router JNR1010 Version 1.0.0.24 Software: Netgear Route...

Belkin N600 Spoofing Vulnerability

Belkin N600 is a wireless dual-band router product. Belkin F9K1102 2 device firmware version 2.10.17 uses an incorrect algorithm when selecting the ID value within the DNS query header. This could allow a remote attacker to exploit this vulnerability for response spoofing by predicting the value...

JVN#69462495: WL-330NUL information management vulnerability

WL-330NUL provided by ASUS Japan Inc. is a portable wireless LAN router. WL-330NUL contains an issue in information management. Impact An attacker that can access the product may obtain the WPA2-PSK passphrase. Solution Update the Firmware Update the firmware to the latest version according to th...

Advantech Switch Bash Environment Variable Code Injection Exploit

This Metasploit module exploits the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This Metasploit module targets the 'ping.sh' CGI script, accessible through the Boa web server on Advantech switches. This Metasploit module was tested against firmwa...

CVE-2015-6492

Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of service memory corruption and device crash via a crafted HTTP request...

ZyXEL PMG5318-B20A Incorrect Authorization Vulnerability

ZyXEL PMG5318-B20A is a wireless switch product from Hopkins ZyXEL Technology. A security vulnerability exists in the ZyXEL PMG5318-B20A using firmware version V100AANC0b5. A remote attacker can exploit the vulnerability to modify the system configuration...

PROLiNK H5004NK ADSL Wireless Modem - Multiple Vulnerabilities

Exploit Title: PROLiNK H5004NK ADSL Wireless Modem Multiple Vulnerabilities Discovered by: Karn Ganeshen Reported on: October 13, 2015 Vendor Response: No process to handle vuln reports Vendor Homepage: http://www.prolink2u.com/newtemp/datacom/adsl-modem-router/381-h5004nk.html Version Affected:...

ZYXEL PMG5318-B20A - OS Command Injection

Exploit Title: ZyXEL PMG5318-B20A OS Command Injection Vulnerability Discovered by: Karn Ganeshen CERT VU 870744 Vendor Homepage: www.zyxel.com Version Reported: Firmware version V100AANC0b5 CVE-2015-6018 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6018 Vulnerability Details CWE-20 :...

ZYXEL PMG5318-B20A - OS Command Injection

ZYXEL PMG5318-B20A - OS Command Injection Exploit Title: ZyXEL PMG5318-B20A OS Command Injection Vulnerability Discovered by: Karn Ganeshen CERT VU 870744 Vendor Homepage: www.zyxel.com Version Reported: Firmware version V100AANC0b5 CVE-2015-6018...

Callisto 821+R3 Cross Site Request Forgery

Hello list! After all my advisories about vulnerabilities in Callisto 821+ http://seclists.org/fulldisclosure/2011/Aug/1 and recent advisory about Callisto 821+R3, here is new one. Because vendor ignored in 2011 all my letters and subsequent my public disclosure of vulnerabilities and new devices...

NETGEAR N600 WIRELESS DUAL BAND WNDR3400 - Multiple Vulnerabilities

Title: Multiple vulnerabilities in NETGEAR N600 WIRELESS DUAL BAND WNDR3400 ==================================================================================== Notification Date: 4/14/2014 Affected Vendor: NETGEAR N600 WIRELESS DUAL BAND WNDR3400 Firmware Version: Firmware Version 1.0.0.38 AND...

Barracuda Web Filter <= 5.0.0.012 Remote Command Execution

The remote Barracuda Web Filter device is running a firmware version at or prior to 5.0.0.012. It is, therefore, affected by a remote command execution vulnerability in the web administration interface. An authenticated, remote attacker can exploit this, via a specially crafted request to...

GPON G-93RG1 Cross Site Request Forgery / Code Execution

CSRF Demo Exploit -- document.auto.submit;...

GPON Home Router FTP G-93RG1 - Cross-Site Request Forgery Command Execution

GPON Home Router FTP G-93RG1 - Cross-Site Request Forgery Command Execution CSRF Demo Exploit -- document.auto.submit;...

GPON Home Router FTP G-93RG1 - Cross-Site Request Forgery / Command Execution

CSRF Demo Exploit -- document.auto.submit;...

Edimax PS-1206MF - Web Admin Auth Bypass Vulnerability

Exploit for hardware platform in category web applications Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi,...

AirLive IP Surveillance Camera there is a command injection vulnerability, a large number of products affected-vulnerability warning-the black bar safety net

A large number of AirLive IP Surveillance Camera is exposed there is a command injection vulnerability, an attacker can use this vulnerability to steal user login credentials and control equipment. The vulnerability principle and scope of impact OvisLink company manufactured a large number of...