29 matches found
Allegro Software RomPager Misfortune Cookie (CVE-2014-9222) Scanner
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Allegro Software RomPager 'Misfortune Cookie' CVE-2014-9222 Scanner", 'Description' = %q This module scans for HTTP servers that appear to be...
Allegro Software RomPager Misfortune Cookie (CVE-2014-9222) Authentication Bypass
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Allegro Software RomPager 'Misfortune Cookie' CVE-2014-9222 Authentication Bypass", 'Description' = %q This module exploits HTTP servers that...
Critical Flaws in Syringe Pump, Device Gateways Threaten Patient Safety
Two previously undocumented, critical vulnerabilities in widely deployed medical devices have sparked patient-safety and data-privacy concerns. Flaws in the Qualcomm Life Capsule Datacaptor Terminal Server and the Becton Dickinson BD Alaris TIVA Syringe Pump have been acknowledged by the vendors...
VulnCheck KEV: CVE-2014-9222
AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that triggers memory corruption, aka the "Misfortune Cookie" vulnerability...
Router Vulnerabilities Disclosed in July Remain Unpatched
Details on serious vulnerabilities in a number of routers freely distributed by a major Thai ISP were published on Monday after private disclosures made to the vendors in July went unanswered. Researcher Pedro Ribeiro of Agile Information Security found accessible admin accounts and command...
Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Authentication Bypass
This module exploits HTTP servers that appear to be vulnerable to the 'Misfortune Cookie' vulnerability which affects Allegro Software Rompager versions before 4.34 and can allow attackers to authenticate to the HTTP service as an administrator without providing valid credentials. This module...
hacklib - Pentesting, Port Scanning, and Logging in anywhere with Python
Toolkit for hacking enthusiasts using Python. hacklib is a Python module for hacking enthusiasts interested in network security. It is currently in active development. Installation To get hacklib, simply run in command line: pip install hacklib hacklib also has a user interface. To use it, you ca...
Multiple Vendors (RomPager <= 4.34) - Misfortune Cookie Router Authentication Bypass
No description provided by source...
RomPager 4.34 Authentication Bypass
Title: Misfortune Cookie Exploit RomPager = 4.34 router authentication remover Date: 17/4/2016 CVE: CVE-2015-9222 http://mis.fortunecook.ie Vendors: ZyXEL,TP-Link,D-Link,Nilox,Billion,ZTE,AirLive,... Vulnerable models: http://mis.fortunecook.ie/misfortune-cookie-suspected-vulnerable.pdf Versions...
RomPager 4.34 - Misfortune Cookie Router Authentication Bypass
Exploit for hardware platform in category web applications Title: Misfortune Cookie Exploit RomPager = 4.34 router authentication remover Date: 17/4/2016 CVE: CVE-2015-9222 http://mis.fortunecook.ie Vendors: ZyXEL,TP-Link,D-Link,Nilox,Billion,ZTE,AirLive,... Vulnerable models:...
RomPager 4.34 (Multiple Router Vendors) - Misfortune Cookie Authentication Bypass
RomPager 4.34 Multiple Router Vendors - Misfortune Cookie Authentication Bypass Title: Misfortune Cookie Exploit RomPager = 4.34 router authentication remover Date: 17/4/2016 CVE: CVE-2015-9222 http://mis.fortunecook.ie Vendors: ZyXEL,TP-Link,D-Link,Nilox,Billion,ZTE,AirLive,... Vulnerable models...
RomPager 4.34 (Multiple Router Vendors) - 'Misfortune Cookie' Authentication Bypass
Title: Misfortune Cookie Exploit RomPager = 4.34 router authentication remover Date: 17/4/2016 CVE: CVE-2015-9222 http://mis.fortunecook.ie Vendors: ZyXEL,TP-Link,D-Link,Nilox,Billion,ZTE,AirLive,... Vulnerable models: http://mis.fortunecook.ie/misfortune-cookie-suspected-vulnerable.pdf Versions...
CERT Warns of Hard-Coded Credentials in DSL SOHO Routers
DSL routers from a number of manufacturers contain hard-coded credentials that could allow a hacker to access the devices via telnet services and remotely control them. An advisory published Tuesday by the DHS-sponsored CERT at the Software Engineering Institute at Carnegie Mellon University said...
http-vuln-misfortune-cookie NSE Script
Detects the RomPager 4.07 Misfortune Cookie vulnerability by safely exploiting it. See also: http-vuln-cve2013-6786.nse Script Arguments slaxml.debug See the documentation for the slaxml library. http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline,...
Allegro v4.34 权限提升漏洞
Allegro v4.34 权限提升漏洞 1.漏洞分析 在RomPager 4.34版之前（RomPager软件已有10多年的历史）存在一个严重的漏洞，这个漏洞被称为厄运 cookie（Misfortune Cookie），这是因为它可以让黑客通过操作cookie来控制HTTP请求的“幸运值”。 这个漏洞编号为CVE-2014-9222，如果攻击者向存在漏洞的RomPager服务器发送特定请求，会使得这类网关设备内存紊乱，攻击者获得管理权限。 这个漏洞正在影响全球1200万台路由器安全， D-Link、 TP-Link、华为、中兴等品牌均受到影响，攻击者可以利用漏洞远程控制设备及监控流量...
With Misfortune-Cookies-doom cookies to ROM-0 Bug patch-vulnerability warning-the black bar safety net
This article is just for fun, especially to those who like to adjust the system's embedded hack. So this is not a legitimate fix ROM-0 Bugs means fun is by one bug to fix another bug. Let's open thebeginning to find our fun. As I an article the Misfortune Cookie decryption of the write, we can be...
Allegro RomPager 4.07 < 4.34 Multiple Vulnerabilities (Misfortune Cookie)
Binary data 8614.prm...
Pirelli Home Broadband Routers Exposed for Two Years
ISP-issued home broadband routers have been a shooting gallery for researchers and hackers alike looking for, and successfully exploiting, shocking vulnerabilities. One disclosed by a researcher in Spain this week is symptomatic of the problem to a disturbing degree. Researcher Eduardo Novella...
Allegro RomPager HTTP Cookie Management Remote Code Execution Vulnerability (Misfortune Cookie)
Nessus was able to overwrite the request path by sending a specially crafted cookie to the remote web server. It is, therefore, affected by multiple vulnerabilities : - A flaw in HTTP cookie management in the embedded web server allows a remote attacker to execute arbitrary code with administrati...
CVE-2014-9222
AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that triggers memory corruption, aka the "Misfortune Cookie" vulnerability...