Comfast CF-E4 命令注入漏洞

The Comfast CF-E4 is a wireless router produced by Comfast Corporation. The Comfast CF-E4 2.6.0.1 version has a command injection vulnerability. This vulnerability stems from incorrect handling of the parameter “timestr” in the file /cgi-bin/mbox-config?method=SET§ion=ntptimezone within the...

PT-2026-8365

Smoothwall Express 3.1-SP4-polar-x86 64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the NTP SERVER parameter. Attackers can send POST requests to the time.cgi endpoint with script payloads in the...

MiracleLinux 7 : ntp-4.2.6p5-29.2.0.1.el7.AXS7 (AXSA:2020-199:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-199:01 advisory. ntp: ntpd using highly predictable transmit timestamps could result in time change or DoS CVE-2020-13817 ntp: DoS on client ntpd using server mode...

MiracleLinux 4 : ntp-4.2.6p5-5.4.0.1.AXS4 (AXSA:2016-045:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-045:01 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which...

MiracleLinux 3 : ntp-4.2.2p1-9.2.1AXS3 (AXSA:2009-58:02)

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2009-58:02 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. The ntp package contains utilities and...

MiracleLinux 4 : ntp-4.2.6p5-15.0.1.AXS4 (AXSA:2019-3823:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-3823:01 advisory. Security Fix - NTPntpqntpdcIPv4IPv6 CVE-2018-12327 CVEJVNhttp://jvndb.jvn.jp/ Tenable has extracted the preceding description block directly from the...

MiracleLinux 7 : ntp-4.2.6p5-22.0.1.el7.AXS7 (AXSA:2015-852:03)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-852:03 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which...

MiracleLinux 7 : chrony-2.1.1-1.0.1.el7.AXS7 (AXSA:2015-927:01)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2015-927:01 advisory. A client/server for the Network Time Protocol, this program keeps your computer's clock accurate. It was specially designed to support systems with...

MiracleLinux 7 : ntp-4.2.6p5-28.0.1.el7.AXS7 (AXSA:2018-2935:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2935:01 advisory. ntp: Authenticated DoS via Malicious Config Option CVE-2017-6463 ntp: Denial of Service via Malformed Config CVE-2017-6464 ntp: Buffer Overflow in...

MiracleLinux 7 : ntp-4.2.6p5-25.0.1.el7.AXS7 (AXSA:2016-1181:02)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-1181:02 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which...

MiracleLinux 3 : ntp-4.2.2p1-9.2.2AXS3 (AXSA:2009-434:03)

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2009-434:03 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. The ntp package contains utilities and daemons that...

CVE-2025-66052 Command injection in Vivotek IP7137 cameras

Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "systemntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to CVE-2025-66050, administrative access...

CVE-2025-64091

This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device...

CVE-2025-64091

The connected sources identify CVE-2025-64091 as affecting Zenitel ICX500 and ICX510 platforms. The vulnerability enables an authenticated attacker to execute commands via the device’s NTP configuration, described as a command-injection issue in the NTP configuration path. Reported by multiple fe...

CVE-2025-64091 Authenticated Remote Code Execution in the NTP-configuration

This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device...

CVE-2025-23437

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nordtramper ntp-header-images header-images-rotator allows Reflected XSS.This issue affects ntp-header-images: from n/a through = 1.2...

CVE-2024-39351

A vulnerability regarding improper neutralization of special elements used in an OS command 'OS Command Injection' is found in the NTP configuration. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models wi...

PT-2026-1842

Name of the Vulnerable Software and Affected Versions Network Device Firmware affected versions not specified Description This issue enables authenticated attackers to execute commands through the NTP-configuration of the device. The vulnerability involves a command injection within the NTP...

CVE-2020-36910

Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizardsystem.cgi pages. Attackers can exploit the 'NTPServerIP' parameter with default credentials to execute arbitrary shell commands as root...

CVE-2020-36910 Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter

Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizardsystem.cgi pages. Attackers can exploit the 'NTPServerIP' parameter with default credentials to execute arbitrary shell commands as root...