The vulnerability of the getSaveConfig function (/cgi-bin/cstecgi.cgi?action=save&setting) in the TOTOLINK EX200 router software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the getSaveConfig function /cgi-bin/cstecgi.cgi?action=save&setting in the TOTOLINK EX200 router software arises due to a buffer overflow occurring during the processing of the httphost parameter. Exploiting this vulnerability allows an attacker to compromise the...

The vulnerability of the UploadCustomModule (/cgi-bin/cstecgi.cgi) function in the TOTOLINK EX1200L router software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the UploadCustomModule /cgi-bin/cstecgi.cgi function in TOTOLINK EX1200L router microprogramming software arises due to buffer overflows in the stack during the processing of the File parameter. Exploiting this vulnerability allows a malicious actor to compromise the...

netty-codec-http: Allocation of Resources Without Limits or Throttling

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

The vulnerability of the loginauth function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK CP450 router’s microprogramming system, which allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the loginauth function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK CP450 router’s microprogramming system is related to the issue of data being written outside the buffer in memory when processing the httphost parameter. Exploiting this vulnerability allows a malicious...

The vulnerability of the setWizardCfg function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK N350RT router’s software, which allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setWizardCfg function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK N350RT router microprogramming system is related to the issue of data being written outside of the buffer in memory when processing the ssid parameter. Exploiting this vulnerability allows an attacker ...

The vulnerability of the UploadCustomModule function in the cgi-bin/cstecgi.cgi file of the TOTOLINK CP900 router’s microprogramming software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the UploadCustomModule function in the cgi-bin/cstecgi.cgi file of the TOTOLINK CP900 router’s microprogramming system is related to the issue of data being written outside the buffer during the processing of the File parameter. Exploiting this vulnerability allows a maliciou...

PT-2024-5931 · Tenda · Tenda Fh1201

Name of the Vulnerable Software and Affected Versions: Tenda FH1201 version 1.2.0.14 408 Description: The issue is related to a stack overflow in the fromNatlimit function via the page parameter. This allows attackers to cause a Denial of Service DoS via a crafted POST request. The vulnerability...

PT-2024-6506 · D Link · D-Link Dir-860L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-860L version 2.03 Description: The issue is related to a buffer overflow vulnerability in the gena.cgi file of the D-Link DIR-860L router's firmware. This vulnerability is caused by the lack of length verification for the SID field...

PT-2024-7660 · Tenda · Tenda Fh1206

Name of the Vulnerable Software and Affected Versions: Tenda FH1206 version 02.03.01.35 Description: The issue is caused by a stack overflow in the fromNatlimit function via the page parameter. This allows attackers to cause a Denial of Service DoS via a crafted POST request to the affected API...

The vulnerability of Xerox WorkCentre 7220 microprogrammed software, related to buffer overflow in the stack, allows a hacker to execute arbitrary code.

The vulnerability of Xerox WorkCentre 7220 microprogrammed software is related to buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted POST request...

OpenMediaVault rpc.php Authenticated Cron Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenMediaVault rpc.php Authenticated Cron Remote Code Execution', 'Description' = %q OpenMediaVault allows an authenticated user to create cron...

CVE-2024-28804

An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Stored Cross-site scripting XSS can occur via POST...

PT-2025-18145

Name of the Vulnerable Software and Affected Versions Apache httpd mod auth openidc module affected versions not specified Description A flaw in the mod auth openidc module for Apache httpd allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request...

CVE-2024-7158

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnetenabled leads to command...

CVE-2024-7158 TOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injection

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnetenabled leads to command...

CVE-2024-7158 TOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injection

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnetenabled leads to command...

CVE-2024-7158

CVE-2024-7158 affects TOTOLINK A3100R (v4.1.2cu.5050_B20200504). The vulnerability is in the HTTP POST Request Handler’s setTelnetCfg function (/cgi-bin/cstecgi.cgi): manipulation of the telnet_enabled argument enables command injection. Impact is remote exploitation with potential high severity ...

CVE-2024-7066

A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/configtimesync.php of the component HTTP POST Request Handler. The manipulation of the argument ntpserver leads to os command...

CVE-2024-7066 F-logic DataCube3 HTTP POST Request config_time_sync.php os command injection

A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/configtimesync.php of the component HTTP POST Request Handler. The manipulation of the argument ntpserver leads to os command...

CVE-2024-7066 F-logic DataCube3 HTTP POST Request config_time_sync.php os command injection

A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/configtimesync.php of the component HTTP POST Request Handler. The manipulation of the argument ntpserver leads to os command...