283 matches found
D-Link DSL-2730U Wireless N 150 - Cross-Site Request Forgery
Author : B GOVIND Exploit Title : DLink DSL-2730U Wireless N 150, Change DNS Configuration bypassing ‘admin’ privilege Date : 01-03-2017 Vendor Homepage : http://www.dlink.co.in Firmware Link : ftp://support.dlink.co.in/firmware/DSL-2730U Affected version : Hardware ver C1, Firmware ver: IN1.0.0...
D-Link DSL-2730U Wireless N 150 - Cross-Site Request Forgery
D-Link DSL-2730U Wireless N 150 - Cross-Site Request Forgery Author : B GOVIND Exploit Title : DLink DSL-2730U Wireless N 150, Change DNS Configuration bypassing ‘admin’ privilege Date : 01-03-2017 Vendor Homepage : http://www.dlink.co.in Firmware Link : ftp://support.dlink.co.in/firmware/DSL-273...
IPFire < 2.19 Core Update 101 - Remote Command Execution
Exploit Title: IPFire 2.19 Update Core 101 XSS to CSRF to Remote Command Execution Date: 04/05/2016 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.ipfire.org Version: lesser-than 2.19 Core Update 101 Category: Remote Command Execution / XSS Google dork: Tested on: IPFire...
IPFire < 2.19 Core Update 101 - Remote Command Execution
Exploit for cgi platform in category web applications Exploit Title: IPFire 2.19 Update Core 101 XSS to CSRF to Remote Command Execution Date: 04/05/2016 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.ipfire.org Version: lesser-than 2.19 Core Update 101 Category: Remote Command...
ZTE SOHO ROUTERWEB_SHELL_CMD.GCH 远程命令执行漏洞
漏洞概要 2014 年 3 月 3 日，Rapid7 团队发布了中兴 F460 / F660 后门信息1，任何可以访问设备的用户都可以直接访问一个命令执行的 Web 界面，以 root 权限执行任意命令。 上述设备在中国境内被广泛应用，俗称“电信光猫”。 漏洞描述 ZTE 生产的 SOHO Router 的一些型号中，Web 根目录（/home/httpd ）下存在 /webshellcmd.gch 文件，没有任何访问控制，可以直接执行任意系统命令。 以下几点值得注意： Rapid7 于 2014 年 3 月 3 日公布此漏洞，但是根据搜索结果，此问题早在 2012...
Security Advisory - No Authentication Vulnerability on the Serial Port of the UAP2105
The UAP2105 serves as a radio access device in the uBro solutions. As one of the AP series products developed on the basis of 3GPP R99/R4/R5/R6 FDD, the UAP2105 complies with the R8 HNB standard and provides Small Office and Home Office SOHO and home users with improved indoor coverage. With the...
Backdoor and RCE found in 8 TOTOLINK router models
Hello, Please find a text-only version below sent to security mailing-lists. The complete version on analysing the backdoor in TOTOLINK products is posted here: https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html === text-version of the advisory without...
ZTE SOHO ROUTER WEB_SHELL_CMD.GCH 远程命令执行
1、漏洞概要2014 年 3 月 3 日，Rapid7 团队发布了中兴 F460 / F660 后门信息1，任何可以访问设备的用户都可以直接访问一个命令执行的 Web 界面，以 root 权限执行任意命令。上述设备在中国境内被广泛应用，俗称“电信光猫”。2.1漏洞描述ZTE 生产的 SOHO Router 的一些型号中，Web 根目录（/home/httpd ）下存在 /webshellcmd.gch 文件，没有任何访问控制，可以直接执行任意系统命令。以下几点值得注意：Rapid7 于 2014 年 3 月 3 日公布此漏洞，但是根据搜索结果，此问题早在 2012...
60+ Vulnerabilities In 22 SOHO Routers
Dear PacketStorm community, we are a group of security researchers doing our IT Security Master's Thesis at Universidad Europea de Madrid. As a part of the dissertation, we have discovered multiple vulnerability issues on the following SOHO routers: 1. Observa Telecom AW4062 2. Comtrend WAP-5813n...
Exploit Kit Delivers Pharming Attacks Against SOHO Routers
Attacks targeting small office and home router DNS settings, long a target for network intruders seeking to redirect web traffic to malicious sites, have for the first time been included in an exploit kit—one that specializes in cross-site request forgery attacks. An exploit kit has been spotted ...
DDoS Botnet Leverages Thousands of Insecure SOHO Routers
Small office and home office SOHO routers are an increasingly common target for cybercriminals, not because of any vulnerability, but because most routers are loosely managed and often deployed with default administrator credentials. A new report suggests that hackers are using large botnet of te...
Event tracking: ZTE router SOHO Router）Backdoor has been clear-vulnerability warning-the black bar safety net
2 0 1 4 year 3 month, the black bar safety net coverage of the ZTE company ZTE production of the SOHO Router models the router was traced to the presence of the back door. ZTE products and Incident Response Team in the month to make a response, and in 6 months in ZTE website released a...
IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection
IPFire - CGI Web Interface Authenticated Bash Environment Variable Code Injection !/usr/bin/env python Exploit Title : IPFire = 2.15 core 82 Authenticated cgi Remote Command Injection ShellShock Exploit Author : Claudio Viviani Vendor Homepage : http://www.ipfire.org Software Link:...
Watchguard SOHO 2.2 - Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2082/info The SOHO 2.2 is a popular SOHO firewall by Watchguard Technologies Inc. A vulnerability exists in Watchguard SOHO 2.2 firewalls with firmware versions 2.2.1 and below that could allow a remote attacker to execut...
SonicWALL SOHO 5.1.7 Web Interface Multiple Remote Input Validation Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/12984/info Multiple remote input validation vulnerabilities affect SonicWALL SOHO. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generat...
NetPilot/Soho Blue Router 6.1.15 - Privilege Escalation
No description provided by source. pdf...
NetPilot/Soho Blue Router 6.1.15 - Privilege Escalation
NetPilot/Soho Blue Router 6.1.15 - Privilege Escalation. Webapps exploit for hardware platform pdf...
Huawei E355信息泄漏和跨站请求伪造漏洞
Bugtraq ID:66017 CVE ID:CVE-2013-6031 Huawei E355是一款家用SOHO路由器设备。 Huawei E355存在信息泄漏和跨站请求伪造漏洞，通过直接访问/api脚本，攻击者可利用漏洞获取敏感信息。此外构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 Huawei E355 目前没有详细解决方案提供： http://www.huawei.com/ This module requires Metasploit: http//metasploit.com/download Current source:...
DNS SOHO Router Pharming Attack Takes 300,000 Routers
More than 300,000 small office and home office routers, most in Europe and Asia, were compromised in a campaign that started in mid-December, continuing a rash of security incidents involving home and small business networking equipment. Researchers at Team Cymru published a report today on the...
Pentagram Cerberus P 6363 DSL Router - Multiple Vulnerabilities
Exploit for hardware platform in category web applications 1. Prolog Cerberus P 6363 is simple SOHO class router. Its producer claims that it may act as a 4 port switch and has an advanced firewall ... Device management is only possible through WWW GUI and because of that, GUI was targeted and is...