Embedthis Software GoAhead 代码问题漏洞

Embedthis Software GoAhead is an open source, small embedded web server from Embedthis Software. A code issue vulnerability exists in Embedthis Software GoAhead version 6.0.0 and earlier, which stems from the presence of a null pointer dereference vulnerability that could allow a remote attacker ...

CVE-2024-46215

A vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub445BDC function within the /usr/sbin/goahead program; The strcpy function is executed without checking the length of the string, leading to a buffer overflow...

PT-2024-31924 · Km08-708H +1 · Km08-708H +1

Name of the Vulnerable Software and Affected Versions: KM08-708H version 1.1 Description: A buffer overflow issue exists due to the strcpy function being executed without checking the length of the string in the sub 445BDC function within the /usr/sbin/goahead program. This leads to a buffer...

CVE-2024-46215

KM08-708H-v1.1 contains a buffer overflow in the /usr/sbin/goahead binary, caused by unsafe use of strcpy in the sub_445BDC() function. This vulnerability is documented across multiple feeds (NVD/Red Hat/CVE records) and affects the KM08-708H device. Exploitation details are not provided in these...

Embedthis GoAhead Embedded Web Server Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Embedthis GoAhead Embedded Web Server Directory Traversal', 'Description' = %q This module exploits a directory traversal vulnerability in the...

The vulnerability in the embedded web server software of GoAhead’s Ethernet switch microprogramming systems of the Moxa EDS-405A and Moxa EDS-408A series allows a intruder to cause service interruptions.

The vulnerability in the embedded web server software of GoAhead’s Ethernet switch microprogramming devices of the Moxa EDS-405A and Moxa EDS-408A series is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Schneider Electric Modicon M340 GoAhead Webserver Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2015-7937)

Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data. This plugin only works with Tenable.ot. Please visit...

GoAhead Web Server 2.5 HTML Injection

Exploit Title: GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities Date: 25/9/2023 Exploit Author: Syed Affan Ahmed ZEROXINN Vendor Homepage: https://www.embedthis.com/goahead/ Affected Version: 2.5 may be others. Tested On Version: 2.5 in ZTE AC3630...

GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities

Exploit Title: GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities Date: 25/9/2023 Exploit Author: Syed Affan Ahmed ZEROXINN Vendor Homepage: https://www.embedthis.com/goahead/ Affected Version: 2.5 may be others. Tested On Version: 2.5 in ZTE AC3630...

The vulnerability of the GoAhead microprogramming software component of D-Link DIR-823G routers allows a hacker to execute arbitrary commands.

The vulnerability of the GoAhead microprogramming software for D-Link DIR-823G routers exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through...

Rockwell Automation products using GoAhead Web Server Use After Free (CVE-2019-5096)

An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this reques...

Rockwell Automation products using GoAhead Web Server Loop with Unreachable Exit Condition (CVE-2019-5097)

A denial-of-service vulnerability exists in the processing of multi- part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the...

Rockwell Automation products using GoAhead Web Server

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Products using GoAhead Web Server Vulnerabilities: Infinite Loop, Use after Free 2. RISK EVALUATION Successful exploitation of these vulnerabilities could have a high...

EmbedThis GoAhead Remote Code Execution (CVE-2021-42342)

An unrestricted file upload vulnerability exists in EmbedThis GoAhead Web Server. The vulnerability is due to improper validation of user form variables passed to the file upload filter...

The vulnerability of the hashFirst() function in GoAhead’s embedded web server software for Robustel R1510 VPN routers allows a hacker to cause a service failure.

The vulnerability of the hashFirst function in GoAhead’s embedded web server-based VPN router software, Robustel R1510, is related to the lack of measures taken to sanitize input data. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially...

CVE-2021-41615

websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 or RFC 2617 section 3.2.1. NOTE:...

CVE-2021-41615

websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 or RFC 2617 section 3.2.1. NOTE:...

CVE-2021-41615

websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 or RFC 2617 section 3.2.1. NOTE:...

Hardcoded credentials

websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 or RFC 2617 section 3.2.1. NOTE:...

CVE-2021-41615

The CVE-2021-41615 entry relates to GoAhead WebServer 2.1.8 (websda.c) having insufficient nonce entropy because nonce calculation uses a hardcoded value (onceuponatimeinparadise) that does not comply with RFC 7616/2617 secret-data guidelines. The vulnerability is documented with a high CVSS v3.1...