Multiple Phicomm products have security vulnerabilities

The Phicomm FIR151B A2, among others, is a wireless router from the Chinese company Fusion Phicomm. A security vulnerability exists in Phicomm, which stems from the currenttime parameter of its time function allowing an attacker to achieve remote command execution. The following versions are...

CVE-2022-37779: Undefined Security Weakness

Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution RCE vulnerability via the sendnum parameter of the ping function...

CVE-2022-37777: Undefined Security Weakness

Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers 3.0.1.17 and earlier were discovered to contain a remote command execution RCE vulnerability via the trHops parameter of the tracert function...

CVE-2022-37780: Undefined Security Weakness

Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution RCE vulnerability via the pingAddr parameter of the tracert function...

CVE-2022-38531: Improper Neutralization of Special Elements used in an OS Command

FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnerable to Remote Command Execution in the ping function...

PT-2022-24067 · Phicomm · Phicomm Fir303B A2 +3

Name of the Vulnerable Software and Affected Versions: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers version V3.0.1.17 Description: A remote command execution issue was discovered, which can be exploited via the current time parameter of the time function. Recommendations: For...

PT-2022-24070 · Phicomm · Phicomm Fir151B A2 +3

Name of the Vulnerable Software and Affected Versions: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers version 3.0.1.17 Description: The issue is related to a remote command execution vulnerability. This vulnerability can be exploited via the pingAddr parameter of the tracert...

PT-2022-24439 · Fpt · Fpt G-97Rg3 +1

Name of the Vulnerable Software and Affected Versions: FPT G-97RG6M version R4.2.98.035 FPT G-97RG3 version R4.2.43.078 Description: The issue allows for Remote Command Execution in the ping function. Recommendations: For FPT G-97RG6M version R4.2.98.035, consider disabling the ping function unti...

PT-2022-24066 · Phicomm · Phicomm Fir303B A2 +3

Name of the Vulnerable Software and Affected Versions: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers versions 3.0.1.17 and earlier Description: A remote command execution issue was found, which can be exploited via the trHops parameter of the tracert function. Recommendations: Fo...

CVE-2022-37778: Undefined Security Weakness

Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution RCE vulnerability via the currenttime parameter of the time function...

Multiple Phicomm products have security vulnerabilities

The Phicomm FIR151B A2, among others, is a wireless router from the Chinese company Fusion Phicomm. A security vulnerability exists in Phicomm, which stems from the trHops parameter of its tracert function that allows an attacker to achieve remote command execution. The following versions are...

Hitachi RAID Manager SRA: Operating System Command Injection Vulnerability

Hitachi RAID Manager SRA is a storage replication adapter software from Hitachi, Japan. A security vulnerability exists in Hitachi RAID Manager Storage Replication Adapter that originates from it allowing remote authenticated users to execute arbitrary OS commands via OS command injection...

CVE-2022-31814

pfSense pfBlockerNG through 2.1.426 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected...

PT-2022-20948 · Unknown · Pfsense Pfblockerng

Name of the Vulnerable Software and Affected Versions: pfSense pfBlockerNG versions 2.1.4 26 and earlier Description: The issue allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. It is estimated that over 388,000 devices may be...

Cisco Small Business RV110W Router Arbitrary Command Execution

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W arises from the copying of buffers without checking the size of the input data during the processing of user fields in incoming HTTP packets. Exploiting...

Cisco Small Business RV110W Router Arbitrary Command Execution

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W arises from the copying of buffers without checking the size of the input data during the processing of user fields in incoming HTTP packets. Exploiting...

CVE-2021-28398: Improper Neutralization of Special Elements used in an OS Command

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScri...

PT-2022-7694 · Drawio +1 · Drawio +1

Name of the Vulnerable Software and Affected Versions: drawio versions prior to 20.3.0 Description: The issue is related to the incorrect neutralization of special elements used in an OS command, which can allow a remote attacker to execute arbitrary commands. Recommendations: For versions prior ...

Exploit for Code Injection in Combodo Itop

iTop RCE via SSTI - CVE-2022-24780 exploit iTop --debu...

CVE-2022-36601: Undefined Security Weakness

The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534. This issue allows unauthenticated attackers to gain root privileges on the affected device and access sensitive data or execute arbitrary commands...