CVE-2020-35755

An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a luciservice Read NVRAM Direct Access Information Leak. The luciservice deamon running on port 7777 provides a sub-category of commands for which Read is prepended. Commands in this category are able to directly read the...

CVE-2020-35756

An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a luciservice GETPASS Configuration Password Information Leak. The luciservice daemon running on port 7777 does not require authentication to return the device configuration password in cleartext when using the GETPASS...

PT-2021-11847

Name of the Vulnerable Software and Affected Versions: Libre Wireless LS9 LS1.5/p7040 devices affected versions not specified Description: An issue was discovered that allows direct access to the device configuration NVRAM, which contains sensitive information such as the Wi-Fi password in...

Libre Wireless Access Control Vulnerability

The Libre Wireless LS9 is a networking device from Libre Wireless, Inc. A security vulnerability exists in the Libre Wireless LS9 LS1.5/p7040 devices. The vulnerability stems from a luci service daemon running on port 7777 returning the device configuration password in plaintext without...

PT-2021-11848

Name of the Vulnerable Software and Affected Versions: Libre Wireless LS9 LS1.5/p7040 devices affected versions not specified Description: An issue was discovered where the luci service daemon running on port 7777 does not require authentication to return the device configuration password in...

Scientific Linux Security Update : luci on SL6.x i386/x86_64 (20131121)

A flaw was found in the way the luci service was initialized. If a system administrator started the luci service from a directory that was writable to by a local user, that user could use this flaw to execute arbitrary code as the root or luci user. CVE-2013-4482 A flaw was found in the way luci...

luci: paster hidden untrusted path and "command" (callable association) injection

A flaw was found in the way the luci service was initialized. If a system administrator started the luci service from a directory that was writable to by a local user, that user could use this flaw to execute arbitrary code as the root or luci user...