660 matches found
CVE-2020-35755
An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a luciservice Read NVRAM Direct Access Information Leak. The luciservice deamon running on port 7777 provides a sub-category of commands for which Read is prepended. Commands in this category are able to directly read the...
PT-2021-11847
Name of the Vulnerable Software and Affected Versions: Libre Wireless LS9 LS1.5/p7040 devices affected versions not specified Description: An issue was discovered that allows direct access to the device configuration NVRAM, which contains sensitive information such as the Wi-Fi password in...
PT-2021-11848
Name of the Vulnerable Software and Affected Versions: Libre Wireless LS9 LS1.5/p7040 devices affected versions not specified Description: An issue was discovered where the luci service daemon running on port 7777 does not require authentication to return the device configuration password in...
Libre Wireless LS9 访问控制错误漏洞
Libre Wireless LS9 is a network device from Libre Wireless, Inc. Libre Wireless LS9 LS1.5/p7040 devices. an access control error vulnerability exists that stems from the luci service daemon running on port 7777 providing a subclass of commands with the Read prefix. Such commands can directly read...
Libre Wireless 访问控制错误漏洞
The Libre Wireless LS9 is a networking device from Libre Wireless, Inc. A security vulnerability exists in the Libre Wireless LS9 LS1.5/p7040 devices. The vulnerability stems from a luci service daemon running on port 7777 returning the device configuration password in plaintext without...
OpenWrt 操作系统命令注入漏洞
OpenWrt is a Linux distribution for embedded devices. A command injection vulnerability exists in applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07. A remote authenticated user can exploit this vulnerability to inject arbitrary commands via a POST...
CVE-2021-28961: Improper Neutralization of Special Elements used in an OS Command
applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests...
PT-2021-2490 · Openwrt · Openwrt
Name of the Vulnerable Software and Affected Versions: OpenWrt 19.07 Description: The issue is related to the DDNS package in OpenWrt 19.07, where the detail.lua file allows remote authenticated users to inject arbitrary commands via POST requests to the /cgi-bin/luci API endpoint, specifically t...
CVE-2020-13859
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...
CVE-2020-13859
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...
Design/Logic Flaw
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...
CVE-2020-13859
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...
PT-2021-9676
Name of the Vulnerable Software and Affected Versions Mofi Network MOFI4500-4GXeLTE version 4.0.8-std Description An issue was discovered that allows the undocumented system account mofidev to login to the "cgi-bin/luci/quick/wizard" management interface without a password. This is due to a forma...
CVE-2020-13859: Improper Authentication
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...
CVE-2019-25015
LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID...
CVE-2019-25015
LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID...
Cross site scripting
LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID...
CVE-2019-25015
LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID...
CVE-2019-25015
LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID...
CVE-2019-25015
CVE-2019-25015 affects LuCI in OpenWrt 18.06.0–18.06.4, enabling stored XSS via a crafted SSID. The vulnerability lies in LuCI's web interface handling SSID input, allowing an attacker to inject script that persists in the page. Multiple connected sources confirm the issue and reference a commit ...