Default credentials

Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account...

CVE-2018-14941

Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for the /webapp.py URI...

CVE-2018-14942

Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATIONGETFILE" or "POST /PY/EMULATIONEXPORT" with FileName=../../../passwd in the POST data...

CVE-2018-14943

Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account...

Directory traversal

Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATIONGETFILE" or "POST /PY/EMULATIONEXPORT" with FileName=../../../passwd in the POST data...

CVE-2018-14941

CVE-2018-14941 affects Harmonic NSG 9000 devices. The issue allows remote authenticated users to read the webapp.py source code via a direct request to the /webapp.py URI, exposing source and potentially sensitive logic. According to the NVD metrics, confidentiality impact is HIGH (CVSS3) with ne...

CVE-2018-14942

The CVE-2018-14942 entry concerns Harmonic NSG 9000 devices. The vulnerability allows remote authenticated users to perform directory traversal via POST requests, e.g. POST /PY/EMULATION_GET_FILE or POST /PY/EMULATION_EXPORT with FileName=../../../passwd. This is the explicit risk described in mu...

CVE-2018-14943

CVE-2018-14943 affects Harmonic NSG 9000 devices and is due to default credentials: admin (nsgadmin), guest (nsgguest), and config (nsgconfig). The CVE entry cites high-impact potential (confidentiality, integrity, availability) with network access and no user interaction required. Connected reco...

CVE-2018-14943

Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account...

CVE-2018-14941

Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for the /webapp.py URI...

CVE-2018-14942

Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATIONGETFILE" or "POST /PY/EMULATIONEXPORT" with FileName=../../../passwd in the POST data...

CVE-2018-14941: Exposure of Sensitive Information to an Unauthorized Actor

Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for the /webapp.py URI...

PT-2018-12817

Name of the Vulnerable Software and Affected Versions Harmonic NSG 9000 affected versions not specified Description The issue allows remote authenticated users to read the webapp.py source code by making a direct request for the "/webapp.py" API endpoint. Recommendations For Harmonic NSG 9000,...

CVE-2018-14943: Use of Hard-coded Credentials

Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account...

CVE-2018-14942: Improper Limitation of a Pathname to a Restricted Directory

Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATIONGETFILE" or "POST /PY/EMULATIONEXPORT" with FileName=../../../passwd in the POST data...

PT-2018-12819

Name of the Vulnerable Software and Affected Versions Harmonic NSG 9000 affected versions not specified Description The issue concerns default passwords for certain accounts on the Harmonic NSG 9000 device. Specifically, the admin account has a default password of nsgadmin, the guest account has ...

PT-2018-12818

Name of the Vulnerable Software and Affected Versions Harmonic NSG 9000 affected versions not specified Description The issue allows remote authenticated users to conduct directory traversal attacks. This can be demonstrated by sending a POST request to the "/PY/EMULATION GET FILE" or...

Secure Web - Error: Cannot open the page - too many http redirections

After the NSG Session times out and the user attempts to start Secure Web, the following error message appears "Cannot open the page - too many http redirections " - then it disappears and a message "Check your credentials - Logon " appears. " 2016-11-11T08:02:45.345+0100 ",,INFO...