CVE-2023-3306: Improper Access Control

A vulnerability was found in Ruijie RG-EW1200G EW3.01B11P204. It has been declared as critical. This vulnerability affects unknown code of the file app.09df2a9e44ab48766f5f.js of the component Admin Password Handler. The manipulation leads to improper access controls. The attack can be initiated...

CVE-2023-26800

Ruijie Networks RG-EW1200 Wireless Routers EW3.01B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upgradeConfirm function...

Command injection

RG-EW1200G PRO Wireless Routers EW3.01B11P204, RG-EW1800GX PRO Wireless Routers EW3.01B11P204, and RG-EW3200GX PRO Wireless Routers EW3.01B11P204 were discovered to contain multiple command injection vulnerabilities via the data.ip, data.protocal, data.iface and data.package parameters in the...

CVE-2023-26800: Improper Neutralization of Special Elements used in a Command

Ruijie Networks RG-EW1200 Wireless Routers EW3.01B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upgradeConfirm function...

CVE-2023-27796

RG-EW1200G PRO Wireless Routers EW3.01B11P204, RG-EW1800GX PRO Wireless Routers EW3.01B11P204, and RG-EW3200GX PRO Wireless Routers EW3.01B11P204 were discovered to contain multiple command injection vulnerabilities via the data.ip, data.protocal, data.iface and data.package parameters in the...

CVE-2023-26800

CVE-2023-26800 affects Ruijie Networks RG-EW1200 Wireless Routers (EW_3.0(1)B11P204). The vulnerability is a command injection via the params.path parameter in the upgradeConfirm function. Public sources describe an authenticated/remote-executable impact with network attack vector, no user intera...

CVE-2023-27796: Improper Neutralization of Special Elements used in a Command

RG-EW1200G PRO Wireless Routers EW3.01B11P204, RG-EW1800GX PRO Wireless Routers EW3.01B11P204, and RG-EW3200GX PRO Wireless Routers EW3.01B11P204 were discovered to contain multiple command injection vulnerabilities via the data.ip, data.protocal, data.iface and data.package parameters in the...

CVE-2021-35109

Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges in Snapdragon Connectivity, Snapdragon Mobile...

CVE-2021-35122

CVE-2021-35122 affects Qualcomm Snapdragon family devices (Auto/Compute/Connectivity/CIoT/Industrial IoT/Mobile/Wearables). The flaw stems from improper input validation, allowing a non-secure region to modify RG permissions of IO space xPUs, enabling local privilege escalation with high impact o...

CVE-2021-35109

The connected PT-2022-10427 entry describes CVE-2021-35109 impacting Qualcomm Snapdragon components: Snapdragon Connectivity and Snapdragon Mobile. Root cause involves possible address manipulation when APP-NS is configuring an RG and attempts to merge address ranges across components. The vulner...

CVE-2021-35122: Improper Input Validation

Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables...

Malicious code in rg-engineering (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a81fe86fbd180749739291f89ef2bdf0c40ad84604650692b3e661db6b0eb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5782 Malicious code in rg-engineering (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a81fe86fbd180749739291f89ef2bdf0c40ad84604650692b3e661db6b0eb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Ruijie Networks RG-EG Series Routers SQL Injection Vulnerability (CNVD-2022-66402)

Ruijie RG-EG series gateway EG350 is a Ruijie gateway product. sql injection vulnerability exists in RG-EG series gateway EG350 alarmService.php, which allows remote attackers to submit special SQL requests to manipulate the database and obtain sensitive information or execute arbitrary code. cod...

CVE-2022-33128

RG-EG series gateway EG350 EGRGOS 11.16 was discovered to contain a SQL injection vulnerability via the function getalarmAction at /alarmpi/alarmService.php...

Sql injection

RG-EG series gateway EG350 EGRGOS 11.16 was discovered to contain a SQL injection vulnerability via the function getalarmAction at /alarmpi/alarmService.php...

CVE-2022-33128

RG-EG series gateway EG350 EGRGOS 11.16 was discovered to contain a SQL injection vulnerability via the function getalarmAction at /alarmpi/alarmService.php...

CVE-2022-33128

The CVE-2022-33128 entry describes a SQL injection in the RG-EG Series gateway RG350 (EG350/EG_RGOS 11.1(6)). The vulnerability resides in the alarmService.php function get_alarmAction, enabling attackers to submit crafted SQL via a request to /alarm_pi/alarmService.php. Reported impact across so...

PT-2022-21703

Name of the Vulnerable Software and Affected Versions RG-EG series gateway EG350 EG RGOS version 11.16 Description The issue is related to a SQL injection vulnerability. It can be exploited via the get alarmAction function at the "/alarm pi/alarmService.php" API endpoint. Recommendations For RG-E...

CVE-2022-33128: Improper Neutralization of Special Elements used in an SQL Command

RG-EG series gateway EG350 EGRGOS 11.16 was discovered to contain a SQL injection vulnerability via the function getalarmAction at /alarmpi/alarmService.php...