CVE-2024-7469 Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_vpn_web_custom.php sslvpn_config_mod os command injection

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been declared as critical. This vulnerability affects the function sslvpnconfigmod of the file /vpn/listvpnwebcustom.php of the component Web Interface. The manipulation of the argument template/stylenum lea...

CVE-2024-7468

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been classified as critical. This affects the function sslvpnconfigmod of the file /vpn/listservicemanage.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os...

CVE-2024-7467

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 and classified as critical. Affected by this issue is the function sslvpnconfigmod of the file /vpn/listipnetwork.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os...

CVE-2024-7468

The CVE-2024-7468 issue affects Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface (sslvpn_config_mod in /vpn/list_service_manage.php). The root cause is parameter manipulation (template/stylenum) enabling OS command injection, with remote access and public exploit disclosure (VDB-273561). A...

CVE-2024-7468 Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_service_manage.php sslvpn_config_mod os command injection

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been classified as critical. This affects the function sslvpnconfigmod of the file /vpn/listservicemanage.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os...

CVE-2024-7467 Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_ip_network.php sslvpn_config_mod os command injection

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 and classified as critical. Affected by this issue is the function sslvpnconfigmod of the file /vpn/listipnetwork.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os...

CVE-2024-7467 Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_ip_network.php sslvpn_config_mod os command injection

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 and classified as critical. Affected by this issue is the function sslvpnconfigmod of the file /vpn/listipnetwork.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os...

CVE-2024-7467

The CVE-2024-7467 issue affects Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 (Web Interface) in the /vpn/list_ip_network.php endpoint. The root cause is manipulation of the template/stylenum parameter in the sslvpn_config_mod function, leading to command injection that can be exploited remotely. Pub...

D-Link DIR-600 OS Command Injection Vulnerability

The D-Link DIR-600 is a wireless router from China's AUO D-Link. An operating system command injection vulnerability exists in the D-Link DIR-600 version 2.18 and earlier, which stems from the fact that manipulation of service parameters can lead to os command injection. No details of the...

PT-2024-5396 · Raisecom · Raisecom Msg2200 +3

Name of the Vulnerable Software and Affected Versions: Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 version 3.90 Description: The issue is related to the function sslvpn config mod of the file /vpn/list vpn web custom.php in the web interface of the affected devices. It is caused by the failur...

PT-2024-5394 · Raisecom · Raisecom Msg2200 +3

Name of the Vulnerable Software and Affected Versions: Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 version 3.90 Description: A critical issue affects the sslvpn config mod function of the /vpn/list service manage.php file in the Web Interface component. The manipulation of the template and...

CVE-2024-7357 D-Link DIR-600 soap.cgi soapcgi_main os command injection

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DIR-600 up to 2.18. It has been rated as critical. This issue affects the function soapcgimain of the file /soap.cgi. The manipulation of the argument service leads to os command injection. The attack may be initiated remotely. The...

CVE-2024-34021

Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution...

CVE-2024-34021

Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution...

CVE-2024-34021

CVE-2024-34021 affects ELECOM wireless LAN routers, enabling Unrestricted Upload of a File with Dangerous Type (CWE-434) by an authenticated administrator, leading to arbitrary OS command execution. Connected sources confirm affected models and that the root cause is file upload with dangerous ty...

Exploit for OS Command Injection in Php

Put the files that need scanning into urls.txt and then run...

JVN#06672778: Multiple vulnerabilities in ELECOM wireless LAN routers

Multiple wireless LAN routers provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. Unrestricted Upload of File with Dangerous Type CWE-434 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 6.8 CVE-2024-34021 OS Command Injection CWE-78...

Multiple vulnerabilities in FutureNet NXR series, VXR series and WXR series

Overview FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain multiple vulnerabilities listed below. Initialization of a Resource with an Insecure Default CWE-1188 - CVE-2024-31070 Active Debug Code CWE-489 - CVE-2024-36475 OS Command Injection CWE-78 -...

CVE-2024-5670 Softnext Mail SQR Expert and Mail Archiving Expert - OS Command Injection

The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server...

CVE-2024-7175

A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182B20201102 and classified as critical. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ipDoamin leads to os command injection. The attack can be initiated...