Moxa AWK-3131A Operating System Command Injection Vulnerability

Moxa AWK-3131A is a wireless access device from Moxa. An operating system command injection vulnerability exists in the Telnet, SSH, and console login functions of the Moxa AWK-3131A using firmware versions 1.4 through 1.7. A remote attacker can exploit this vulnerability to execute root OS...

ASUS infosvr - Authentication Bypass Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ASUS infosvr Auth Bypass Command Execution', 'Description' = %q This module exploits an authentication bypass vulnerability in the infosvr service...

Belkin N750 Unauthorized Access Vulnerability

Belkin N750 is a wireless router product. The Belkin N750 version 1.10.22 has a security vulnerability in its implementation where an unauthenticated remote user can enable telnet and gain root access without a password by sending an HTTP request to set.cgi...

ASUS infosvr Authentication Bypass Command Execution Exploit

This Metasploit module exploits an authentication bypass vulnerability in the infosvr service running on UDP port 9999 on various ASUS routers to execute arbitrary commands as root. This Metasploit module launches the BusyBox Telnet daemon on the port specified in the TelnetPort option to gain an...

ASUS infosvr Authentication Bypass Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ASUS infosvr Auth Bypass Command Execution', 'Description' = %q This module exploits an authentication bypass vulnerability in the infosvr service...

Zyxel Multy X (AC3000 Tri-Band WiFi System) Device Backdoor Vulnerability

The Zyxel Multy X AC3000 Tri-Band WiFi System device is a wireless networking kit from Hopkins ZyXEL Technologies. A security vulnerability exists in the Zyxel Multy X AC3000 Tri-Band WiFi System device, which arises from the program failing to use the correct mechanism to protect the UART.An...

Design/Logic Flaw

A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.cgi. When enabled the telnet session requires no password and provides root access...

CVE-2018-1146

A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.cgi. When enabled the telnet session requires no password and provides root access...

CVE-2018-1146

A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.cgi. When enabled the telnet session requires no password and provides root access...

CVE-2018-1146

CVE-2018-1146 affects Belkin N750 router firmware 1.10.22. A remote unauthenticated user can send a crafted HTTP request to set.cgi to enable telnet, after which telnet runs with root access and no password. This is documented across multiple sources (NVD entry and CNVD listing). The provided con...

CVE-2018-1146

A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.cgi. When enabled the telnet session requires no password and provides root access...

Lutron Quantum 3.2.243 Information Disclosure

Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware Date: 20-03-2018 Exploit Author: David Castro Contact: https://twitter.com/SadFud75 Vendor Homepage: http://www.lutron.com Software Link:...

Moxa EDR-810 Cleartext Transmission of Password Vulnerability

Summary An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as...

The vulnerability of the registration and accounting subsystem of the wireless access point for Moxa AWK-3131A industrial systems allows a intruder to execute arbitrary commands with root privileges.

The vulnerability of the registration and accounting subsystem of the wireless access point for Moxa AWK-3131A industrial systems exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious act...

Design/Logic Flaw

ubiQuoss Switch VP5208A creates a bcmpassword file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH or TELNET if it is enabled...

CVE-2018-10024

ubiQuoss Switch VP5208A creates a bcmpassword file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH or TELNET if it is enabled...

CVE-2018-10024

ubiQuoss Switch VP5208A creates a bcmpassword file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH or TELNET if it is enabled...

CVE-2018-10024

The vulnerability CVE-2018-10024 affects UbiQuoss Switch VP5208A. On a failed login attempt, the device creates a bcm_password file at /cgi-bin/ containing user credentials in cleartext, which can be retrieved via an HTTP request. These credentials can be used to access the system via SSH (or TEL...

Command injection

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...

CVE-2017-14459

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...