CVE-2024-21880

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway formerly known as Enphase allows OS Command Injection.This issue affects Envoy: 4.x = 7.x...

CVE-2024-42741

TOTOLINK X5000r v9.1.0cu.2350_b20230313 is affected by an OS command injection in /cgi-bin/cstecgi.cgi via setL2tpServerCfg. Authenticated attackers can send a crafted packet to execute arbitrary commands. Subsystems: the vulnerability is tied to the setL2tpServerCfg function in cstecgi.cgi, enab...

CVE-2024-42745

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-42741

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-42748

TOTOLINK X5000r (v9.1.0cu.2350_b20230313) has an OS command injection in /cgi-bin/cstecgi.cgi setWiFiWpsCfg. The vulnerability arises from inadequate input validation, allowing authenticated attackers to execute arbitrary commands via crafted packets over the network. Public references in connect...

CVE-2024-42742

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated Attackers can send malicious packet to execute arbitrary commands...

PT-2024-30122 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000r version 9.1.0cu.2350 b20230313 Description: The issue is related to an OS command injection vulnerability in the setL2tpServerCfg function within the /cgi-bin/cstecgi.cgi file. Authenticated attackers can exploit this by sendi...

CVE-2024-42747

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-42745

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-42745

CVE-2024-42745 describes a command-injection vulnerability in TOTOLINK X5000r (v9.1.0cu.2350_b20230313) located in the file /cgi-bin/cstecgi.cgi within the setUPnPCfg function. The issue allows authenticated attackers to send a crafted packet to execute arbitrary commands on the device. This is a...

CVE-2024-42741

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-42742

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-39091

An OS command injection vulnerability in the ccmdebug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request...

CVE-2024-42744

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-42744

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-42743

The CVE-2024-42743 entry affects TOTOLINK X5000R, version 9.1.0cu.2350_b20230313, where the /cgi-bin/cstecgi.cgi file’s setSyslogCfg function allows OS command injection. The publicly available connected sources describe that an authenticated attacker can send a crafted packet to execute arbitrar...

CVE-2024-42743

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-42747

CVE-2024-42747 – TOTOLINK X5000r : A command-injection in /cgi-bin/cstecgi.cgi (setWanIeCfg) on TOTOLINK X5000r v9.1.0cu.2350_b20230313 allows authenticated attackers to execute arbitrary commands. The vulnerability stems from insufficient input validation in the affected function. Exploitation c...

CVE-2024-21879 URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway formerly known as Envoy allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and 8.2.4225...

CVE-2024-21878 Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Enphase IQ Gateway formerly known as Envoy allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currentl...