CVE-2020-24033

fs.com S3900 24T4S の最新バージョン 1.7.1 およびそれ以前の全バージョン、CSRF バックステージ管理者 このフォームには認証またはトークン認証メカニズムが存在しないため、クロスサイトリクエストフォージェリ（ユーザーアカウント追加）により、フルアクセス権を持つユーザーを追加することが可能です。 S3900 24T4S 上のすべてのフォームはクロスサイトリクエストフォージェリ攻撃の対象となります。 root@kitploit: User Name admin guest admin2 Access Level 0...

EUVD-2023-34771

Malicious code in bioql PyPI...

CVE-2023-30350

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password...

The vulnerability of the microprogramming software for FS S3900-24T4S devices, due to deficiencies in access control, allows attackers to escalate their privileges and bypass the administrator password.

The vulnerability of the microprogramming software for FS S3900-24T4S switches is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges and bypass the administrator password...

CVE-2023-30350

CVE-2023-30350 affects FS S3900-24T4S switches. The issue is inadequate access control that lets an authenticated user with guest privileges escalate to admin and reset the admin password. Evidence shows exploitation in practice (e.g., exploit/test material via Packet Storm and Exploit-DB) demons...

CVE-2023-30350

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password...

CVE-2023-30350

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password...

CVE-2023-30350: Undefined Security Weakness

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password...

FS-S3900-24T4S Privilege Escalation

Exploit Title: FS-S3900-24T4S Privilege Escalation Date: 29/04/2023 Exploit Author: Daniele Linguaglossa & Alberto Bruscino Vendor Homepage: https://www.fs.com/ Software Link: not available Version: latest Tested on: latest CVE : CVE-2023-30350 import sys import telnetlib def exploitargs: printar...

FS-S3900-24T4S - Privilege Escalation Exploit

Exploit Title: FS-S3900-24T4S Privilege Escalation Exploit Author: Daniele Linguaglossa & Alberto Bruscino Vendor Homepage: https://www.fs.com/ Software Link: not available Version: latest Tested on: latest CVE : CVE-2023-30350 import sys import telnetlib def exploitargs: printargs if lenargs != ...

FS-S3900-24T4S - Privilege Escalation

Exploit Title: FS-S3900-24T4S Privilege Escalation Date: 29/04/2023 Exploit Author: Daniele Linguaglossa & Alberto Bruscino Vendor Homepage: https://www.fs.com/ Software Link: not available Version: latest Tested on: latest CVE : CVE-2023-30350 import sys import telnetlib def exploitargs: printar...

PT-2023-2944 · Fs · Fs S3900-24T4S

Name of the Vulnerable Software and Affected Versions: FS S3900-24T4S affected versions not specified Description: The issue is related to insufficient access control in the software of FS S3900-24T4S switches. It allows a remote attacker to escalate their privileges and reset the admin password...

fs.com S3900-24T4S Cross-Site Request Forgery Vulnerability

The fs.com S3900-24T4S is a Gigabit stackable switch from China's Feixiang Innovation fs. fs S3900-24T4S switch is equipped with 24 10/100/1000Base-T ports, 4 10G SFP+ uplink ports, supports up to 6 switches stacking, and is easy to operate with highly secure service processing capability, flexib...

CVE-2020-24033

An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with...

CVE-2020-24033

An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with...

CVE-2020-24033

The CVE-2020-24033 issue affects fs.com S3900-24T4S switches (version 1.7.0 and earlier). The root cause is a lack of authentication or token-based protection for form actions, enabling remote attackers to forge requests on behalf of a site administrator and alter all settings, including deleting...

CVE-2020-24033

An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with...