CVE-2022-36486

TOTOLINK N350RT V9.3.5u.6139B20201216 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile...

PT-2022-23408 · Totolink · Totolink N350Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N350RT version 9.3.5u.6139 B20201216 Description: A command injection issue was found via the FileName parameter in the UploadFirmwareFile function. Recommendations: For version 9.3.5u.6139 B20201216, consider restricting access to t...

PT-2022-23790 · Totolink · Totolink A7000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A7000R version 9.1.0u.6115 B20201022 Description: A command injection issue was found in the UploadFirmwareFile function via the FileName parameter. Recommendations: For version 9.1.0u.6115 B20201022, avoid using the FileName paramet...

TOTOLINK A7000R 操作系统命令注入漏洞

The TOTOLINK A7000R is a wireless router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOLINK A7000R version V9.1.0u.6115B20201022, which stems from a command injection issue in the FileName parameter of the UploadFirmwareFile method...

TOTOLINK A3700R 操作系统命令注入漏洞

The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOLINK A3700R version V9.1.2u.6134B20201202, which stems from a command injection issue in the FileName parameter of the UploadFirmwareFile method...

CVE-2022-0715

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series SMT Series ID=18: UPS 09.8 and prior / SMT Series...

CVE-2021-45738

TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName...

The vulnerability of the cgi-bin/upload_firmware.cgi component of the D–Link DIR-823G router’s microprogramming system allows a hacker to cause a service failure.

The vulnerability of the cgi-bin/uploadfirmware.cgi component of the D–Link DIR-823G router’s microprogramming system is related to the lack of authentication. Exploiting this vulnerability can allow an attacker to cause a service failure...

D-Link DIR-823G Denial of Service Vulnerability (CNVD-2021-85890)

The D-Link DIR-823G is an AC1200M dual-band gigabit wireless router. a denial of service vulnerability exists in the /cgi-bin/uploadfirmware.cgi component of the D-Link DIR-823G version 1.02B05. An attacker can exploit this vulnerability to cause a denial of service...

CVE-2020-25366

An issue in the component /cgi-bin/uploadfirmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service DoS via unspecified vectors...

PT-2019-19691 · Cobham · Cobham Explorer 710

Name of the Vulnerable Software and Affected Versions: Cobham EXPLORER 710 firmware version 1.07 Description: The issue concerns the lack of firmware image validation in the device. Development scripts that were left in the firmware can be exploited to upload a custom firmware image. This could...

PT-2018-3878 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G devices affected versions not specified Description: The issue is related to the lack of authentication in certain components of the D-Link DIR-823G device's firmware, specifically ExportSettings.sh, upload settings.cgi,...

The vulnerability of the FileUploadController servlet in the web application, which is designed for managing and monitoring printing devices and image processing. SyncThru 6 allows a perpetrator to execute arbitrary code with system privileges.

The vulnerability of the FileUploadController servlet in the web application, which is designed for managing and monitoring printing devices and image processing, exists due to an incorrect path limitation for the restricted directory. Exploiting this vulnerability allows a malicious actor to...

CVE-2015-7925

Cross-site request forgery CSRF vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot...