Humax HG100R Routers Authentication Bypass (CVE-2017-11435)

An authentication bypass vulnerability exists in Humax HG100R Routers. Successful exploitation of this vulnerability would allow remote attackers to gain unauthorized access into the affected system...

Authentication flaw

The Humax Wi-Fi Router model HG100R- 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. The bug is exploitable remotely when the router is configured to expose the management console. The router is not validating the session token...

CVE-2017-11435

The Humax Wi-Fi Router model HG100R- 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. The bug is exploitable remotely when the router is configured to expose the management console. The router is not validating the session token...

CVE-2017-11435

The Humax HG100R-* router (model HG100R- with firmware 2.0.6) is affected by an authentication bypass vulnerability in the management console. The issue arises because the router does not validate the session token for certain API responses under /api, enabling remote attackers to retrieve sensit...

PT-2017-12009

Name of the Vulnerable Software and Affected Versions Humax Wi-Fi Router model HG100R- version 2.0.6 Description The issue allows for an authentication bypass via specially crafted requests to the management console. This can be exploited remotely when the router exposes the management console. T...

CVE-2017-11435: Exposure of Sensitive Information to an Unauthorized Actor

The Humax Wi-Fi Router model HG100R- 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. The bug is exploitable remotely when the router is configured to expose the management console. The router is not validating the session token...

Humax Wi-Fi Router HG100R Authentication Bypass Vulnerability

Humax Wi-Fi Router HG100R is a router device from Humax Digital, Korea. An authentication bypass vulnerability exists in the Humax Wi-Fi Router HG100R version 2.0.6. An attacker can exploit the vulnerability by sending a specially crafted request to the management console to retrieve sensitive...

CVE-2017-7316

An issue was discovered on Humax Digital HG100R 2.0.6 devices. There is XSS on the 404 page...

CVE-2017-7315

An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup, aka GatewaySettings.bin...

Cross site scripting

An issue was discovered on Humax Digital HG100R 2.0.6 devices. There is XSS on the 404 page...

CVE-2017-7316

An issue was discovered on Humax Digital HG100R 2.0.6 devices. There is XSS on the 404 page...

Default credentials

An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup, aka GatewaySettings.bin...

CVE-2017-7316

CVE-2017-7316 affects Humax Digital HG100R devices running firmware 2.0.6, with a reflected XSS on the 404 page. The NVD entry describes network-exposed XSS that requires user interaction (CVSS3: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; base 6.1). Related sources (CNVD/NVD/CVE listings) corroborate t...

CVE-2017-7316

An issue was discovered on Humax Digital HG100R 2.0.6 devices. There is XSS on the 404 page...

CVE-2017-7315

CVE-2017-7315 concerns Humax Digital HG100R devices (version 2.0.6). The vulnerability enables download of the backup file without authentication, and GatewaySettings.bin includes the router credentials in plaintext. This exposes sensitive credentials and configuration to an attacker who can obta...

CVE-2017-7315

An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup, aka GatewaySettings.bin...

Humax Digital HG100R Cross-Site Scripting Vulnerability

The Humax Digital HG100R is a router from the Korean company Humax Digital. A cross-site scripting vulnerability exists in the 404 page in version 2.0.6 of the Humax Digital HG100R. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

PT-2017-17660

Name of the Vulnerable Software and Affected Versions Humax Digital HG100R version 2.0.6 Description An issue was discovered that allows for cross-site scripting XSS on the 404 page. Recommendations For Humax Digital HG100R version 2.0.6, consider disabling access to the 404 page as a temporary...

CVE-2017-7316: Improper Neutralization of Input During Web Page Generation

An issue was discovered on Humax Digital HG100R 2.0.6 devices. There is XSS on the 404 page...

CVE-2017-7315: Missing Authentication for Critical Function

An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup, aka GatewaySettings.bin...