CVE-2023-34275

D-Link DIR-2150 SetNTPServerSettings Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the...

CVE-2023-34275

CVE-2023-34275 describes a remote code execution on the D-Link DIR-2150 router due to a flaw in the SOAP API interface that handles SetNTPServerSettings. The vulnerability stems from improper validation of a user-supplied string before it is used to perform a system call, allowing an attacker to ...

Meinberg LANTIME Web Interface Cross-site Scripting (CVE-2014-5417)

Cross-site scripting XSS vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

TRENDnet TEW-815DAP security vulnerabilities

The TRENDnet TEW-815DAP is a wireless access point from Trendnet, Inc. A security vulnerability exists in TRENDnet TEW-815DAP version 1.0.2. that originates from an easy command injection attack via the dosetNTP function...

CVE-2024-30572

Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntpserver parameter...

CVE-2024-30572

Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntpserver parameter...

PT-2024-23500

Name of the Vulnerable Software and Affected Versions Netgear R6850 version 1.1.0.88 Description A command injection issue was discovered, which can be exploited via the ntp server parameter. Recommendations For Netgear R6850 version 1.1.0.88, avoid using the ntp server parameter until a fix is...

CVE-2024-30572

The Netgear R6850 wireless router, specifically version 1.1.0.88 , contains a command injection vulnerability (CWE-77) rooted in the ntp_server parameter. The flaw occurs because the parameter fails to properly filter constructed command special characters, allowing an attacker to execute arbitra...

TheMoon Botnet Resurfaces, Exploiting EoL Devices to Power Criminal Proxy

A botnet previously considered to be rendered inert has been observed enslaving end-of-life EoL small home/small office SOHO routers and IoT devices to fuel a criminal proxy service called Faceless. "TheMoon, which emerged in 2014, has been operating quietly while growing to over 40,000 bots from...

K000139026: NTP vulnerability CVE-2009-3563

Security Advisory Description ntprequest.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service CPU and bandwidth consumption by using MODEPRIVATE to send a spoofed 1 request or 2 response packet that triggers a continuous exchange of MODEPRIVATE error...

CVE-2024-25468

An issue in TOTOLINK X5000R V.9.1.0u.6369B20230113 allows a remote attacker to cause a denial of service via the hosttime parameter of the NTPSyncWithHost component...

CVE-2024-1309 Resource Consumption Identified in NTP before 4.2.4p8 and 4.2.5

Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1...

CVE-2024-1309 Resource Consumption Identified in NTP before 4.2.4p8 and 4.2.5

Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1...

Trendnet Router Sub_420AE0 Code Execution

The vulnerability of the sub420AE0 function in Trendnet’s router software TEW-824DRU is related to insufficient checking of arguments passed in the command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the system.ntp.server parameter...

PT-2024-1406 · Trendnet · Trendnet Tew-824Dru

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-824DRU version 1.04b01 Description: An issue in the TRENDnet TEW-824DRU allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter in the sub 420AE0 function. The attack can be launched remotel...

PT-2024-1398 · Trendnet · Trendnet Tew-815Dap

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-815DAP version 1.0.2.0 Description: A critical issue affects the do setNTP function of the POST Request Handler component. The manipulation of the NtpDstStart/NtpDstEnd argument leads to command injection, allowing remote attacke...

Vinchin Backup And Recovery 7.2 syncNtpTime Command Injection

CVE ID: CVE-2024-22899 Title: Command Injection Vulnerability in Vinchin Backup and Recovery's syncNtpTime Function in Versions 7.2 and Earlier Description: A critical security vulnerability, identified as CVE-2024-22899, has been discovered in the syncNtpTime function of Vinchin Backup and...

EulerOS Virtualization 2.9.0 : ntp (EulerOS-SA-2023-2990)

According to the versions of the ntp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cpcpdec while loop. An adversary may be able to attack ...

EulerOS Virtualization 2.11.1 : ntp (EulerOS-SA-2023-2734)

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cpcpdec while loop. An adversary may be able to attack...

EulerOS Virtualization 2.11.0 : ntp (EulerOS-SA-2023-2765)

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cpcpdec while loop. An adversary may be able to attack...