CVE-2023-41351

The CVE-2023-41351 entry concerns the Nokia G-040W-Q (Chunghwa Telecom) modem, where an authentication bypass allows an unauthenticated remote attacker to log in via an alternate URL as any existing user (including administrators), enabling arbitrary system operations or service disruption. Docum...

Authentication flaw

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more...

CVE-2023-41350 Chunghwa Telecom NOKIA G-040W-Q - Excessive Authentication Attempts

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more...

CVE-2023-41350

The CVE-2023-41350 entry concerns the Chunghwa Telecom NOKIA G-040W-Q router. The available documents describe an authentication-flaw: insufficient measures to prevent multiple failed authentication attempts, allowing an unauthenticated attacker to craft JavaScript that exposes the captcha, there...

CVE-2023-41350 Chunghwa Telecom NOKIA G-040W-Q - Excessive Authentication Attempts

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more...

Nokia G-040W-Q Security Vulnerability

The Nokia G-040W-Q is a modem from Nokia of Finland. A security vulnerability exists in Nokia G-040W-Q, which originates from an ICMP redirect message input validation vulnerability in the firewall. An unauthenticated, remote attacker can exploit this vulnerability by sending carefully crafted...

Nokia G-040W-Q Security Vulnerability

The Nokia G-040W-Q is a modem from Nokia of Finland. A security vulnerability exists in Nokia G-040W-Q that originates from an authentication bypass vulnerability. An unauthenticated, remote attacker could use this vulnerability to bypass the authentication mechanism and log in to the device via ...

Nokia G-040W-Q Security Vulnerability

The Nokia G-040W-Q is a modem from Nokia of Finland. A security vulnerability exists in Nokia G-040W-Q, which originates from the firewall not blocking ICMP TIMESTAMP requests by default. An unauthenticated, remote attacker can exploit the vulnerability by sending a crafted packet, which could...

Nokia G-040W-Q Security Vulnerability

Nokia G-040W-Q is a modem from Nokia of Finland. A security vulnerability exists in Nokia G-040W-Q, which arises from insufficient filtering of user input. A remote attacker with administrator privileges can use this vulnerability to conduct a command injection attack to execute arbitrary command...

Nokia G-040W-Q Security Vulnerability

The Nokia G-040W-Q is a modem from Nokia of Finland. A security vulnerability exists in Nokia G-040W-Q, which arises from insufficient measures to prevent multiple failed authentication attempts...

Nokia G-040W-Q Security Vulnerability

The Nokia G-040W-Q is a modem from Nokia of Finland. A security vulnerability exists in Nokia G-040W-Q that originates from allowing the use of weak passwords...

PT-2023-27921 · Nokia · Chunghwa Telecom Nokia G-040W-Q

Name of the Vulnerable Software and Affected Versions: Chunghwa Telecom NOKIA G-040W-Q affected versions not specified Description: The issue is related to weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information...

PT-2023-27922 · Nokia · Chunghwa Telecom Nokia G-040W-Q

Name of the Vulnerable Software and Affected Versions: Chunghwa Telecom NOKIA G-040W-Q affected versions not specified Description: The firewall function in the Chunghwa Telecom NOKIA G-040W-Q does not block ICMP TIMESTAMP requests by default. This allows an unauthenticated remote attacker to...

PT-2023-27920 · Nokia · Chunghwa Telecom Nokia G-040W-Q

Name of the Vulnerable Software and Affected Versions: Chunghwa Telecom NOKIA G-040W-Q affected versions not specified Description: The issue is related to insufficient filtering for user input, allowing a remote attacker with administrator privilege to perform a Command Injection attack. This ca...

PT-2023-27919 · Nokia · Chunghwa Telecom Nokia G-040W-Q

Name of the Vulnerable Software and Affected Versions: Chunghwa Telecom NOKIA G-040W-Q affected versions not specified Description: The issue allows an unauthenticated remote attacker to bypass the authentication mechanism and log in to the device using an alternative URL. This enables attackers ...

SolarWinds and its CISO accused of misleading investors before major cyberattack

The Securities and Exchange Commission SEC has announced charges against software company SolarWinds Corporation and its chief information security officer CISO, Timothy G. Brown, for “fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities.” In 202...

AZL-35301 CVE-2023-47090 affecting package telegraf for versions less than 1.29.4-1

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

UBUNTU-CVE-2023-47090

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

CVE-2023-47090

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

g-bau-koblenz.de Improper Access Control vulnerability OBB-3765509

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...