CVE-2024-56334

A flaw was found in the systeminformation library for Node.js. In Windows systems, the SSID parameter of the getWindowsIEEE8021x function is not sanitized before it is passed to cmd.exe. This may allow a remote attacker to execute arbitrary commands on the target system. Mitigation Mitigation for...

Systeminformation has command injection vulnerability in getWindowsIEEE8021x (SSID)

Summary The SSID is not sanitized when before it is passed as a parameter to cmd.exe in the getWindowsIEEE8021x function. This means that malicious content in the SSID can be executed as OS commands. Details I have exploited this vulnerability in a Windows service using version 5.22.11 of the...

The vulnerability of the application software interface “multiple_ssid_htm” of the multifunctional wireless access points manufactured by Advantech, models EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the “multiplessidhtm” application programming interface in the microprogramming-based wireless access points of Advantech models EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO exists due to the lack of measures taken to neutralize the special elements used in the operatin...

CVE-2024-12352

A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This vulnerability affects the function sub40662C of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be initiated remotely. The...

TOTOLINK EX1800T 安全漏洞

The TOTOLINK EX1800T is a Wi-Fi range extender from China's Gion Electronics TOTOLINK. The TOTOLINK EX1800T cstecgi.cgi sub40662C suffers from a stack overflow vulnerability that originates from the failure of the ssid parameter of the sub40662C function of the /cgi-bin/cstecgi.cgi file to...

CVE-2024-11980

CVE-2024-11980 describes a Missing Authentication vulnerability in multiple Billion Electric WiFi routers. Attackers can remotely and unauthenticatedly access a specific router function to obtain partial device information, modify the WiFi SSID, and restart the device. The CVSS 3.1 vector (AV:N/A...

CVE-2024-11980 Billion Electric router - Missing Authentication

Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device...

CVE-2024-11980 Billion Electric router - Missing Authentication

Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device...

Billion Electric多款产品 安全漏洞

Billion Electric M100 and others are a wireless router from China-based Shengda Electric Billion Electric. A security vulnerability exists in various Billion Electric products that stems from improper authentication and allows an attacker to gain direct access to certain features to obtain some...

CVE-2024-50369

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The source of the vulnerability relies on...

PT-2024-9481 · Advantech · Advantech Eki-6333Ac-2G +1

Name of the Vulnerable Software and Affected Versions: Advantech EKI-6333AC-2G versions 1.6.3 and earlier Advantech EKI-6333AC-2GD versions 1.6.3 and earlier Advantech EKI-6333AC-1GPO versions 1.2.1 and earlier Description: The issue exists due to the lack of neutralization of special elements us...

CVE-2024-6247

Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2024-6247 Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability

Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2024-6247 Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability

Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2024-6247

CVE-2024-6247 involves Wyze Cam v3 where the OS command injection occurs through handling of SSIDs embedded in scanned QR codes. The root cause is improper validation of a user-supplied string used in a system call, enabling a local attacker with physical access to execute code as root on affecte...

The vulnerability in the bridge_wireless_main.cgi script of the Netgear XR300 router’s software allows a hacker to induce a service failure.

The vulnerability in the bridgewirelessmain.cgi script of the Netgear XR300 router software lies in the copying of buffers without checking the size of the input data during the processing of the ssid parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by...

CVE-2024-28728

Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to obtain sensitive information via a crafted payload to the WiFi SSID Name field...

CVE-2024-28728

Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to obtain sensitive information via a crafted payload to the WiFi SSID Name field...

PT-2024-22543 · D Link · Dlink Dwr 5G Cpe +1

Name of the Vulnerable Software and Affected Versions: DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 version DWR-2000M 1.34ME Dlink DWR 5G CPE version DWR-2000M 1.34ME Description: The issue allows a local attacker to obtain sensitive information via a crafted payload to the WiFi SSID Name field. Thi...

D-Link DWR-2000M 跨站脚本漏洞

The D-Link DWR-2000M is a wireless router from China AUO D-Link. A security vulnerability exists in the D-Link DWR-2000M. A local attacker can exploit the vulnerability to obtain sensitive information by sending a crafted payload to the WiFi SSID name field...