CVE-2019-7687

cgi-bin/qcmapwebcgi on JioFi 4 jmr1140 AmtelJMR1140R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data...

Cross site scripting

cgi-bin/qcmapwebcgi on JioFi 4 jmr1140 AmtelJMR1140R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data...

PT-2019-18739

Name of the Vulnerable Software and Affected Versions JioFi 4 jmr1140 Amtel JMR1140 R12.07 Description The issue allows remote attackers to obtain the Wi-Fi password by making a "cgi-bin/qcmap web cgi Page=GetWiFi Setting" request and then reading the wpa security key field. Recommendations For...

CVE-2019-7687: Improper Neutralization of Input During Web Page Generation

cgi-bin/qcmapwebcgi on JioFi 4 jmr1140 AmtelJMR1140R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data...

CVE-2019-7746: Cross-Site Request Forgery (CSRF)

JioFi 4 jmr1140 AmtelJMR1140R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmapauth type=getuser request and then reading the token field. This token value can then be used to change the Wi-Fi password or perform a factory reset...

PT-2019-18740

Name of the Vulnerable Software and Affected Versions JioFi 4 jmr1140 Amtel JMR1140 R12.07 Description The issue allows remote attackers to obtain an admin token by making a "/cgi-bin/qcmap auth" type=getuser request and then reading the token field. This token value can then be used to change th...

CVE-2019-7745: Undefined Security Weakness

JioFi 4 jmr1140 AmtelJMR1140R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qcmapwebcgi Page=GetWiFiSetting request and then reading the wpasecuritykey field...

PT-2019-18703

Name of the Vulnerable Software and Affected Versions JioFi 4 jmr1140 Amtel JMR1140 R12.07 Description The issue concerns a reflected XSS vulnerability. It occurs via the Page parameter in the cgi-bin/qcmap web cgi endpoint. The problem arises because no sanitization is performed on user input...