Gryphon Tower 操作系统命令注入漏洞

The Gryphon Tower is a wireless router from Gryphon. The Gryphon Tower suffers from a command injection vulnerability that originates from unauthenticated command injections in multiple parameters in the web interface of /cgi-bin/luci/rc, which can be exploited by an attacker to send a crafted...

PT-2021-13796

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 3 in the controller server service. An unauthenticated remote attacker on the same network can...

PT-2021-13802

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: The issue concerns an unprotected openvpn configuration file in Gryphon Tower routers, which can allow attackers to access the Gryphon homebound VPN network. This exposure can...

PT-2021-13795

Name of the Vulnerable Software and Affected Versions: Gryphon Tower router affected versions not specified Description: An unauthenticated command injection issue exists in the Gryphon Tower router’s web interface at "/cgi-bin/luci/rc". This allows an unauthenticated remote attacker on the same...

PT-2021-13798

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 32 in the controller server service. An unauthenticated remote attacker on the same network ca...

PT-2021-13801

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 49 in the controller server service. An unauthenticated remote attacker on the same network ca...

PT-2021-13797

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 10 in the controller server service. This allows an unauthenticated remote attacker on the sam...

PT-2021-13794

Name of the Vulnerable Software and Affected Versions: Gryphon Tower router affected versions not specified Description: A reflected cross-site scripting issue exists in the url parameter of the "/cgi-bin/luci/site access/" page on the Gryphon Tower router's web interface. An attacker could explo...

PT-2021-13800

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 48 in the controller server service. An unauthenticated remote attacker on the same network ca...

PT-2021-13799

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 41 in the controller server service. An unauthenticated remote attacker on the same network ca...

CVE-2021-20139: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to...

CVE-2021-20137: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/siteaccess/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution...

CVE-2021-20142: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20141: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20140: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20144: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20145: Improper Authentication

Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the LAN interfaces of other users' devices connected to the same service. An attacker could leverage this to make configuration changes to, o...

CVE-2021-20143: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controllerserver service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet t...

CVE-2021-20138: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to th...

Updated ansible packages fix security vulnerability

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...