CVE-2022-33325

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33329

Robustel R1510 OS command injection (CVE-2022-33329) exists in the web server ajax endpoints, including /ajax/set_sys_time/. The root cause is unsafe handling of user-controlled parameters (via functions like sysprintf and system), enabling arbitrary command execution on the device. Talos documen...

CVE-2022-33326

The CVE-2022-33326 family affects Robustel R1510 (3.3.0) Web UI endpoints. The root cause is unsafe command execution via system()-style calls in multiple /ajax/* endpoints (eg /ajax/config_rollback/, /ajax/clear_tools_log/, /ajax/remove_sniffer_raw_log/, /ajax/remove/, /ajax/set_sys_time/) where...

CVE-2022-33325

CVE-2022-33325 relates to OS command injection in Robustel R1510 web_server ajax endpoints. Talos details show unsafe usage of user inputs in functions like sysprintf and direct calls to system(), enabling arbitrary command execution via crafted network requests to endpoints such as /ajax/clear_t...

CVE-2022-33314

CVE-2022-33314 concerns Robustel R1510 web server command injection vulnerabilities. Talos/Cisco reports describe multiple unsanitized user inputs reaching endpoints under /action/ that allow OS command execution via unsafe formatting and system() usage. Root cause involves unsafe handling in cod...

CVE-2022-33329: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The /ajax/setsystime/...

CVE-2022-33327: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33326: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33325: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33314: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities exist in the webserver action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33313: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities exist in the webserver action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33312: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities exist in the webserver action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-28127: Improper Input Validation

A data removal vulnerability exists in the webserver /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability...

Robustel R1510 web_server /action/remove/ API data removal vulnerability

Summary A data removal vulnerability exists in the webserver /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability. Tested Versions Robustel R151...

CVE-2022-33328: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The /ajax/remove/ API...

GHSA-48MJ-P7X2-5JFM Basic auth bypass in esphome

Impact Anyone with webserver enabled and HTTP basic auth configured on 2021.9.1 or older webserver allows OTA update without checking user defined basic auth username & password Patches Patch released in 2021.9.2 Workarounds Disable/remove webserver...

CVE-2021-41104

ESPHome is a system to control the ESP8266/ESP32. Anyone with webserver enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which webserver allows over-the-air OTA updates without checking user defined basic auth username & password. This issue is...

PYSEC-2021-351

ESPHome is a system to control the ESP8266/ESP32. Anyone with webserver enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which webserver allows over-the-air OTA updates without checking user defined basic auth username & password. This issue is...

Default credentials

ESPHome is a system to control the ESP8266/ESP32. Anyone with webserver enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which webserver allows over-the-air OTA updates without checking user defined basic auth username & password. This issue is...

CVE-2021-41104 web_server allows OTA update without checking user defined basic auth username & password

ESPHome is a system to control the ESP8266/ESP32. Anyone with webserver enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which webserver allows over-the-air OTA updates without checking user defined basic auth username & password. This issue is...