CVE-2021-20146

An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon's development and infrastructure. At the time of discovery, the ssh key could be used to login to the development server hosted in Amazon Web Services...

Gryphon Tower operating system command injection vulnerability

A command injection vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from a failure to properly filter user input for special characters, commands, etc. in the parameters of operation 49 in the controllerserver service on the router. An unauthenticate...

Gryphon Tower operating system command injection vulnerability

The Gryphon Tower is a wireless router from Gryphon. A command injection vulnerability exists in Gryphon Tower, which originates from the failure of the parameters of operation 32 in the controllerserver service on the router to correctly filter special characters, commands, etc. entered by the...

Gryphon Tower operating system command injection vulnerability

The Gryphon Tower is a wireless router from Gryphon. A command injection vulnerability exists in Gryphon Tower, which originates from the failure of the parameters of operation 3 in the controllerserver service on the router to correctly filter special characters, commands, etc. entered by the...

Gryphon Tower operating system command injection vulnerability

The Gryphon Tower is a wireless router from Gryphon. The Gryphon Tower suffers from a command injection vulnerability that originates from unauthenticated command injections in multiple parameters in the web interface of /cgi-bin/luci/rc, which can be exploited by an attacker to send a crafted...

PT-2021-13803

Name of the Vulnerable Software and Affected Versions: Gryphon devices affected versions not specified Description: An unprotected ssh private key exists on the Gryphon devices, which could be used to achieve root access to a server affiliated with Gryphon's development and infrastructure. The ss...

CVE-2021-20141: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20144: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20139: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to...

CVE-2021-20142: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20146: Insufficiently Protected Credentials

An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon's development and infrastructure. At the time of discovery, the ssh key could be used to login to the development server hosted in Amazon Web Services...

Gryphon Tower security vulnerability

Gryphon Tower is a wireless router from Gryphon, Inc. Gryphon Tower is vulnerable to an information disclosure vulnerability stemming from the presence of an unprotected ssh private key on the device, which could be exploited by an attacker to gain root access to servers belonging to Gryphon's...

CVE-2021-41021

A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command...

CVE-2021-41021

A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command...

Fortinet FortiNAC security vulnerability

Fortinet FortiNAC is a network access control solution from Fortinet, a US-based company. Fortinet FortiNAC has an elevation of privilege vulnerability that can be exploited to elevate privileges to root via the sudo command...

CVE-2021-41021: Undefined Security Weakness

A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command...

Yealink Device Management Arbitrary Command Execution

The vulnerability of the Yealink Device Management platform lies in the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on behalf of the root user remotely...

CVE-2021-43033

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input received by the server being passed to system calls...

Google Android competition conditions bug

Google Android is a Linux-based open source operating system from Google, Inc. An attacker could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service condition...

Unitrends Backup operating system command injection vulnerability

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A remote code execution vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by an attacker to execute arbitrary code as root...