TOTOLINK EX1200L setParentalRules Buffer Overflow

The vulnerability of the setParentalRules function /cgi-bin/cstecgi.cgi of the TOTOLINK EX1200L router software arises due to a buffer overflow in the stack when processing parameters such as week, sTime, and eTime. Exploiting this vulnerability allows an attacker to compromise the confidentialit...

TOTOLINK EX1200L Login Auth Function

The vulnerability of the loginauth /cgi-bin/cstecgi.cgi function in the TOTOLINK EX1200L router software arises due to buffer overflows in the stack during the processing of the httphost parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

TOTOLINK EX200 Router Loginauth XSS

The vulnerability of the loginauth /cgi-bin/cstecgi.cgi function in the TOTOLINK EX200 router software arises due to buffer overflows in the stack during the processing of the httphost parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

TOTOLINK EX200 Router getSaveConfig Function

The vulnerability of the getSaveConfig function /cgi-bin/cstecgi.cgi?action=save&setting in the TOTOLINK EX200 router software arises due to a buffer overflow occurring during the processing of the httphost parameter. Exploiting this vulnerability allows an attacker to compromise the...

netty-codec-http: Allocation of Resources Without Limits or Throttling

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

TOTOLINK N350RT Router setWizardCfg Function

The vulnerability of the setWizardCfg function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK N350RT router microprogramming system is related to the issue of data being written outside of the buffer in memory when processing the ssid parameter. Exploiting this vulnerability allows an attacker ...

TOTOLINK CP900 Router UploadCustomModule Data Compromise

The vulnerability of the UploadCustomModule function in the cgi-bin/cstecgi.cgi file of the TOTOLINK CP900 router’s microprogramming system is related to the issue of data being written outside the buffer during the processing of the File parameter. Exploiting this vulnerability allows a maliciou...

TOTOLINK CP450 Router Loginauth Function Injection

The vulnerability of the loginauth function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK CP450 router’s microprogramming system is related to the issue of data being written outside the buffer in memory when processing the httphost parameter. Exploiting this vulnerability allows a malicious...

PT-2024-5931 · Tenda · Tenda Fh1201

Name of the Vulnerable Software and Affected Versions: Tenda FH1201 version 1.2.0.14 408 Description: The issue is related to a stack overflow in the fromNatlimit function via the page parameter. This allows attackers to cause a Denial of Service DoS via a crafted POST request. The vulnerability...

PT-2024-6506 · D Link · D-Link Dir-860L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-860L version 2.03 Description: The issue is related to a buffer overflow vulnerability in the gena.cgi file of the D-Link DIR-860L router's firmware. This vulnerability is caused by the lack of length verification for the SID field...

PT-2024-7660 · Tenda · Tenda Fh1206

Name of the Vulnerable Software and Affected Versions: Tenda FH1206 version 02.03.01.35 Description: The issue is caused by a stack overflow in the fromNatlimit function via the page parameter. This allows attackers to cause a Denial of Service DoS via a crafted POST request to the affected API...

Xerox WorkCentre 7220 Buffer Overflow

The vulnerability of Xerox WorkCentre 7220 microprogrammed software is related to buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted POST request...

OpenMediaVault rpc.php Authenticated Cron Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenMediaVault rpc.php Authenticated Cron Remote Code Execution', 'Description' = %q OpenMediaVault allows an authenticated user to create cron...

CVE-2024-28804

An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Stored Cross-site scripting XSS can occur via POST...

PT-2025-18145

Name of the Vulnerable Software and Affected Versions Apache httpd mod auth openidc module affected versions not specified Description A flaw in the mod auth openidc module for Apache httpd allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request...

CVE-2024-7158

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnetenabled leads to command...

CVE-2024-7158 TOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injection

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnetenabled leads to command...

CVE-2024-7158 TOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injection

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnetenabled leads to command...

CVE-2024-7158

CVE-2024-7158 affects TOTOLINK A3100R (v4.1.2cu.5050_B20200504). The vulnerability is in the HTTP POST Request Handler’s setTelnetCfg function (/cgi-bin/cstecgi.cgi): manipulation of the telnet_enabled argument enables command injection. Impact is remote exploitation with potential high severity ...

CVE-2024-7158: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnetenabled leads to command...