NETGEAR R7000P security vulnerabilities

The NETGEAR R7000P is a wireless router from NETGEAR. A buffer overflow vulnerability exists in NETGEAR R7000P v1.3.3.154, which originates from the pptpusernetmask parameter in the ruwanflow.cgi component that fails to correctly validate the length of the input data, and can be exploited by a...

PT-2024-8265 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.3.154 Description: The issue is related to a stack overflow in the ru wan flow.cgi script, specifically via the pptp user netmask parameter. This allows attackers to cause a Denial of Service DoS by sending a crafte...

PT-2024-34529

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version V15.03.06.50 Description: A buffer overflow issue was discovered in the formSetPPTPServer function. This issue affects the PPTP server functionality. Recommendations: For Tenda AC6 version V15.03.06.50, as a temporary...

PT-2024-8254 · NetGear · Netgear R6400 +3

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Netgear XR300 version 1.0.3.78 Netgear R7000P version 1.3.3.154 Netgear R6400 v2 version 1.0.4.128 Description: The issue is related to a stack overflow vulnerability in the bsw pptp.cgi script of Netgear...

PT-2024-8262 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.3.154 Description: The issue is related to a stack overflow in the wiz pptp.cgi script of the Netgear R7000P router's firmware, specifically when handling the pptp user netmask parameter. This allows attackers to...

CVE-2024-51246

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function...

PT-2024-34572 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into "mainfunction.cgi" and execute arbitrary commands by calling the doPPTP function. Recommendations: For Draytek Vigor3900 version...

PT-2024-8545 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.3.154 Description: The issue is related to a stack overflow in the pptp user netmask parameter at the "pptp.cgi" endpoint. This allows attackers to cause a Denial of Service DoS via a crafted POST request. The...

MS02-063 PPTP Malformed Control Data Kernel Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MS02-063 PPTP Malformed Control Data Kernel Denial of Service', 'Description' = %q This module exploits a kernel based overflow when sending...

CVE-2024-5227

TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability...

CVE-2024-5227 TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability

TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability...

CVE-2024-5227 TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability

TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability...

CVE-2024-5227

TP-Link Omada ER605 PPTP VPN username Command Injection (CVE-2024-5227) allows network-adjacent attackers to execute arbitrary code as root by abusing an unsafe username parameter in /usr/bin/pppd. Impact is remote code execution with root privileges if PPTP VPN with LDAP authentication is enable...

(Pwn2Own) TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are only vulnerable if configured to use a PPTP VPN with LDAP authentication. The...

CVE-2024-5227: Improper Neutralization of Special Elements used in an OS Command

TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability...

TP-Link Omada ER605 security vulnerabilities

The TP-LINK Omada ER605 is a VPN router from China P&L TP-LINK. A security vulnerability exists in the TP-Link Omada ER605 that originates from a command injection that can be performed and lead to remote code execution via a PPTP VPN username...

PT-2024-26274 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.19 Description: The issue is related to a Buffer Overflow in the formSetPPTPServer function, which can be exploited via the endIp parameter. Recommendations: For Tenda AC18 version 15.03.05.19, as a temporary...

Shenzhen Libituo Technology LBT-T300-T400 security vulnerabilities

The Shenzhen Libituo Technology LBT-T300-T400 is an industrial router from Shenzhen Libituo Technology China. A security vulnerability exists in the Shenzhen Libituo Technology LBT-T300-T400 v.3.2, which is caused by a buffer overflow vulnerability that can be exploited by a local attacker to...

CVE-2024-2764

A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.48. This affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument endIP leads to stack-based buffer overflow. It is possible to initiate the attack remotely. T...

Tenda AC10 security vulnerabilities

Tenda AC10U is a wireless router from Tenda China. The Tenda AC10U suffers from a stack buffer overflow vulnerability, which originates in the file /goform/SetPptpServerCfg where the parameter endIP of the function formSetPPTPServer fails to correctly validate the length of the input data, which...