CVE-2019-20074

On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page...

CVE-2019-20074

CVE-2019-20074 affects Netis/DL4323 devices. The vulnerability allows any user role to view sensitive information (e.g., user password, FTP password) via the form2saveConf.cgi page, indicating an information disclosure weakness in the device UI. Reported CVSS metrics from NVD indicate network acc...

CVE-2019-20075

On Netis DL4323 devices, pingrttv6.html has XSS Ping6 Diagnostic...

CVE-2019-20075

Netis DL4323 devices expose a cross-site scripting (XSS) vulnerability in the pingrtt_v6.html page (Ping6 Diagnostic). The issue arises from insufficient input validation in the WEB application, permitting crafted data to execute client-side code. Affected component: pingrtt_v6.html on Netis DL43...

CVE-2019-20076

On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter DynDns settings of the Dynamic DNS Configuration...

CVE-2019-20076

CVE-2019-20076 concerns the Netis DL4323 modem, where a stored/reflected cross-site scripting (XSS) vulnerability exists in the DynDns settings page due to the username parameter in form2Ddns.cgi. The issue stems from insufficient input validation in the WEB application, enabling an attacker to i...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability (CNVD-2020-01650)

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability (CNVD-2020-01648)

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

PT-2019-16077

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description The issue exists due to a problem with the hostname parameter in the "form2Ddns.cgi" script, which is part of the Dynamic DNS Configuration. This allows for XSS attacks. Recommendations...

PT-2019-16078

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description A security issue exists due to the presence of a cross-site scripting XSS flaw. This issue is triggered via the username parameter in the "form2userconfig.cgi" endpoint, specifically...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability (CNVD-2020-01649)

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

PT-2019-16079

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description The issue allows any user role to access sensitive information, including user passwords and the FTP password, by visiting the "form2saveConf.cgi" page. Recommendations For Netis DL4323...

PT-2019-16075

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description The issue exists due to a cross-site scripting XSS flaw. Specifically, the urlFQDN parameter in the form2url.cgi endpoint also known as the Keyword field of the URL Blocking Configuratio...

PT-2019-16076

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description The issue exists due to a CSRF flaw, allowing unauthorized actions to be performed via the "form2logaction.cgi" endpoint, specifically to delete all logs. Recommendations For Netis DL432...

CVE-2019-20075: Improper Neutralization of Input During Web Page Generation

On Netis DL4323 devices, pingrttv6.html has XSS Ping6 Diagnostic...

CVE-2019-20071: Cross-Site Request Forgery (CSRF)

On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs...

CVE-2019-20073: Improper Neutralization of Input During Web Page Generation

On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter User Account Configuration...

CVE-2019-20074: Improper Privilege Management

On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page...

PT-2019-16080

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description The issue concerns an XSS vulnerability in the pingrtt v6.html file, specifically affecting the Ping6 Diagnostic feature. Recommendations At the moment, there is no information about a...