CVE-2010-5330

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi aka Show AP info because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSyn...

CVE-2010-5330

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi aka Show AP info because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSyn...

Maine governor signs ISP privacy bill

Less than one week after Maine Governor Janet Mills received one of the nation’s most privacy-protective state bills on her desk, she signed it into law. The move makes Maine the latest US state to implement its own online privacy protections. The law, which will go into effect July 1, 2020, bloc...

PT-2019-6598 · Ubiquiti · Airmax Isp +2

Name of the Vulnerable Software and Affected Versions: Ubiquiti AirOS versions prior to 4.0.1 Ubiquiti AirMax ISP products versions prior to 5.3.5 Ubiquiti AirSync firmware versions prior to 5.4.5 Description: On certain Ubiquiti devices, Command Injection exists via a GET request to "stainfo.cgi...

CVE-2010-5330

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi aka Show AP info because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSyn...

Maine inches closer to shutting down ISP pay-for-privacy schemes

Maine residents are one step closer to being protected from the unapproved use, sharing, and sale of their data by Internet service providers ISPs. A new state bill, already approved by the state House of Representatives and Senate, awaits the governor’s signature. If signed, the bill would provi...

Do High Vanity Bitrates Choke Your Live OTT Service Out of the Gate?

Studies show that video consumption demand is growing faster than capacity. While capacity overhead does exist, current trends suggest that we'll see more bottlenecking on last-hop connectivity, especially with regionally targeted content. By pushing "vanity bitrates" -- those topmost speeds that...

CVE-2019-10478

An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. An unrestricted file upload vulnerability in the Front Circle Controller glytoolcgi/settingfileupload.cgi allows attackers to upload supplied data. This can be used to place attacker controlled code on the filesystem...

CVE-2019-10479

An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacker to gain admin access to the Front Circle Controller web interface...

CVE-2019-10478

An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. An unrestricted file upload vulnerability in the Front Circle Controller glytoolcgi/settingfileupload.cgi allows attackers to upload supplied data. This can be used to place attacker controlled code on the filesystem...

Unrestricted file upload

An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. An unrestricted file upload vulnerability in the Front Circle Controller glytoolcgi/settingfileupload.cgi allows attackers to upload supplied data. This can be used to place attacker controlled code on the filesystem...

Hardcoded credentials

An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacker to gain admin access to the Front Circle Controller web interface...

CVE-2019-10479

An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacker to gain admin access to the Front Circle Controller web interface...

CVE-2019-10478

An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. An unrestricted file upload vulnerability in the Front Circle Controller glytoolcgi/settingfileupload.cgi allows attackers to upload supplied data. This can be used to place attacker controlled code on the filesystem...

CVE-2019-10479

An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacker to gain admin access to the Front Circle Controller web interface...

FTC Demands Broadband Providers Reveal Data Handling Practices

The Federal Trade Commission FTC is putting pressure on internet broadband providers to reveal exactly what data they’re collecting – and how they are using it. The FTC on Tuesday issued orders to seven U.S. ISPs requesting that they detail how they collect, retain, use and disclose information...

Command injection

An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/ispupdateedit.php does not properly validate user input, which leads to...

CVE-2019-7383

An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/ispupdateedit.php does not properly validate user input, which leads to...

CVE-2019-7383

CVE-2019-7383 affects Systrome Cumilon ISG-600C, ISG-600H and ISG-800W with firmware V1.1-R2.1_TRUNK-20181105.bin. The issue is a shell command injection in network/isp/isp_update_edit.php caused by improper validation of the des parameter, enabling arbitrary commands when the ISP file descriptio...

PT-2019-18568 · Systrome · Systrome Cumilon

Name of the Vulnerable Software and Affected Versions: Systrome Cumilon devices with firmware V1.1-R2.1 TRUNK-20181105.bin Description: A shell command injection issue occurs when editing the description of an ISP file due to improper validation of user input in the file network/isp/isp update...