GlobalProtect-Openconnect security vulnerabilities

GlobalProtect-Openconnect is a GlobalProtect VPN client GUI for Linux based on OpenConnect and built with Qt5 to support SAML authentication mode. A security vulnerability exists in GlobalProtect-Openconnect, which is caused by GlobalProtect-Openconnect being set up in a way that allows an...

SonicWall SMA 100 Series Authenticated Command Injection Exploit

This Metasploit module exploits an authenticated command injection vulnerability in the SonicWall SMA 100 series web interface. Exploitation results in command execution as root. The affected versions are 10.2.1.2-24sv and below, 10.2.0.8-37sv and below, and 9.0.0.11-31sv and below. This module...

PT-2021-13821

Name of the Vulnerable Software and Affected Versions: Netgear RAX43 version 1.0.3.96 Description: The issue concerns insufficient protections on the UART interface. A malicious actor with physical access to the device can connect to the UART port via a serial connection, login with default...

Netgear Nighthawk R6700 authorization issue vulnerability

The Netgear Nighthawk R6700 is a wireless router from Netgear USA. An authorization issue vulnerability exists in the Netgear Nighthawk R6700 that stems from the product's lack of adequate protection for UART console access. The vulnerability can be exploited by an attacker to execute commands as...

CVE-2021-23147: Improper Authentication

Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication...

PT-2021-15393

Name of the Vulnerable Software and Affected Versions Netgear Nighthawk R6700 version 1.0.4.120 Description The issue concerns insufficient protections for the UART console, allowing a malicious actor with physical access to the device to connect to the UART port via a serial connection and execu...

PT-2021-23696

Name of the Vulnerable Software and Affected Versions FiberHome ONU GPON AN5506-04-F RP2617 affected versions not specified Description The issue allows an attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool. This is achieved by bypassi...

CVE-2021-20142

An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20138: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to th...

PT-2021-5078 · Cisco · Rv082 +5

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV016 versions affected versions not specified Cisco Small Business RV042 versions affected versions not specified Cisco Small Business RV042G versions affected versions not specified Cisco Small Business RV082 versions...

CVE-2021-34755

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory...

128 Technology Session Smart Router Authorization Vulnerability

128 Technology Session Smart Router is a router. An authorization issue vulnerability exists in the 128 Technology Session Smart Router that stems from an error in the product's handling of authentication requests. An attacker could bypass authentication and execute arbitrary system commands with...

Aruba ClearPass Policy Manager path traversal vulnerability

HPE Aruba ClearPass Policy Manager is a network access control NAC solution. A directory traversal vulnerability exists in HPE Aruba ClearPass Policy Manager. An attacker can exploit the vulnerability to execute arbitrary commands on the server as root user, which could result in complete system...

PT-2021-7268

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR840N EU version 6.20 Description The issue is related to insecure protections for the UART console in the TP-Link TL-WR840N EU router. This allows attackers to connect to the UART port via a serial connection and execute commands ...

CVE-2021-38557

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

CVE-2021-38557

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

CVE-2021-38557

Affected software: raspap-webgui (RaspAP) 2.6.6. Root cause: insecure sudoers permissions permit the www-data user to run /etc/raspap/hostapd/enablelog.sh as root without a password and to overwrite that script with arbitrary executable content. Impact: potential remote code execution as root. Ex...

Cisco Intersight Virtual Appliance Command Execution Root Privileges

The vulnerability of the web interface for managing Cisco Intersight Virtual Appliance software exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands with root privileges remotely...

VulnCheck KEV: CVE-2021-1497

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user...

Fortinet FortiPortal Trust Management Vulnerability

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for MSPs.Fortinet FortiPortal has a trust management issue vulnerability, which stems from the...