Ivanti Secure Access Client 安全漏洞

Ivanti Secure Access Client for Linux is a solution for enabling secure remote access, supporting SSL VPN connections and allowing users to securely access internal network resources e.g., administrative systems, applications, etc. from off-campus. An elevation of privilege vulnerability exists i...

PT-2024-35411 · Sonos · Sonos Era 100

Name of the Vulnerable Software and Affected Versions: Sonos Era 100 affected versions not specified Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos Era 100 smart speakers. The specific flaw exists within the handling ...

The vulnerability of the Command Line Interface (CLI) of the Cisco Network Services Orchestrator software environment allows a malicious actor to elevate their privileges to the root user level. This vulnerability enables a hacker to gain control over network elements called ConfD.

The vulnerability of the command-line interface CLI of the Cisco Network Services Orchestrator software environment relates to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root user level...

The vulnerability of the /web_cste/cgi-bin/product.ini component of the Telnet service in the TOTOLINK CP900L wireless access point’s microprogramming system allows a malicious user to gain root privileges and access the system.

The vulnerability of the /webcste/cgi-bin/product.ini component of the Telnet service in the TOTOLINK CP900L wireless access point software is related to the use of pre-installed user accounts. Exploiting this vulnerability could allow a malicious actor to gain root privileges and access the syst...

CVE-2024-35396

TOTOLINK CP900L v4.1.5cu.798B20221228 was discovered to contain a hardcoded password for telnet in /webcste/cgi-bin/product.ini, which allows attackers to log in as root...

CVE-2024-35396

TOTOLINK CP900L v4.1.5cu.798_B20221228 is affected by a hardcoded password for telnet stored in /web_cste/cgi-bin/product.ini, enabling root login. The CVE entry does not specify a fixed fix; multiple connected sources reference mitigation ideas (e.g., disabling telnet, patching firmware), but no...

(0Day) D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from...

(0Day) D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The...

TOTOLINK CP900L 安全漏洞

The TOTOLINK CP900L is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK CP900L suffers from a hard-coded password vulnerability that originates from the inclusion of a hard-coded password in /webcste/cgi-bin/product.ini, which can be exploited by an attacker to log in as roo...

(0Day) D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

PT-2024-26476 · Totolink · Totolink Cp900L

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP900L version 4.1.5cu.798 B20221228 Description: A hardcoded password issue was found in the /etc/shadow.sample file, allowing attackers to log in as root. Recommendations: For TOTOLINK CP900L version 4.1.5cu.798 B20221228, consider...

CVE-2024-5295

D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2024-5297

D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication...

CVE-2024-5297

D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication...

CVE-2024-5291

D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The...

CVE-2024-5243

TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are...

CVE-2024-5244 TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability

TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability. This vulnerability allows network-adjacent attackers to access or spoof DDNS messages on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices...

pmix: race condition allows attackers to obtain ownership of arbitrary files

OpenPMIx PMIx is vulnerable to a race condition during execution of library code with UID 0, which allows attackers to obtain ownership of arbitrary files...

PT-2024-11945 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC Software affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker ...

TOTOLINK EX200 Hardcoded Password Vulnerability

The TOTOLINK EX200 is a 2.4G wireless range extender from China's TOTOLINK. It is designed to extend the coverage of existing Wi-Fi networks and eliminate "blind spots". The TOTOLINK EX200 suffers from a hard-coded password vulnerability that originates from the /etc/shadow.sample file, which can...