191 matches found
FiberHome Router Directory Traversal Vulnerability
FiberHome routers are a router from FiberHome, a Chinese company. A directory traversal vulnerability exists in /cgi-bin/webproc in FiberHome routers. An attacker can exploit this vulnerability to obtain files on the router...
Directory traversal
On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value...
CVE-2017-15647
FiberHome routers are affected by CVE-2017-15647, a local file inclusion (LFI) in /cgi-bin/webproc via the getpage parameter when coupled with a crafted var:page value. The Nuclei template confirms an LFI vector affecting FiberHome devices, enabling an attacker to read sensitive router files and ...
PT-2017-14139
Name of the Vulnerable Software and Affected Versions FiberHome routers affected versions not specified Description A Directory Traversal issue exists in the /cgi-bin/webproc endpoint via the getpage parameter in conjunction with a crafted var:page value. Recommendations At the moment, there is n...
CVE-2017-15647: Improper Limitation of a Pathname to a Restricted Directory
On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value...
FiberHome - Directory Traversal
Vulnerability Summary The following advisory describes a directory traversal vulnerability found in FiberHome routers. FiberHome Technologies Group “was established in 1974. After continuous and intensive development for over 40 years, its business has been extended to R&D, manufacturing, marketi...
MOVISTAR BHS_RTA ADSL Router - Remote File Disclosure
!/bin/sh MOVISTAR ADSL ROUTER BHSRTA BHSRTAC0019 Remote File Disclosure Vendor: OBSERVA Model: BHSRTA Software: BHSRTACO019 Firmware: 09/08/2012-10:23:25 Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous programs is...
D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure
!/bin/sh D-Link ADSL ROUTER DSL-2730U IN1.02 Remote File Disclosure Modem Name: DSL-2730U/DSL-2750E Time and Date: 2012-05-23 09:51:16 HardwareVersion: U1 Firmware Version: IN1.02/SEA1.04/SEA1.07 Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackeror...
NETGEAR JNR1010 ADSL Router - (Authenticated) Remote File Disclosure
NETGEAR JNR1010 ADSL Router - Authenticated Remote File Disclosure !/bin/sh NETGEAR ADSL ROUTER JNR1010 1.0.0.16 Authenticated Remote File Disclosure Hardware Version: JNR1010 Firmware Version: 1.0.0.16 GUI Language Version: 1.0.0.16 Copyright 2016 c Todor Donev https://www.ethical-hacker.org/...
PLC Wireless Router GPN2.4P21-C-CN - Arbitrary File Disclosure
Exploit Title: PLC Wireless Router GPN2.4P21-C-CN Authorised Arbitrary File Disclosure Date: 28/08/2016 Exploit Author: Rahul Raz Affected Model : GPN2.4P21-C-CNFrimware- W2001EN-00 Vendor: ChinaMobile Tested on: Ubuntu Linux GET...
CVE-2015-7248
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703...
CVE-2015-7248: Exposure of Sensitive Information to an Unauthorized Actor
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703...
CVE-2015-7250: Improper Limitation of a Pathname to a Restricted Directory
Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter...
CVE-2015-7252: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allows remote attackers to inject arbitrary web script or HTML via the errorpage parameter...
CVE-2015-7249: Undefined Security Weakness
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by leveraging the support account to change a password via a cgi-bin/webproc accountpsd action...
PT-2015-7491
Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue allows remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code. Recommendations For ZTE ZXHN H108N R1A devices...
PT-2015-7492
Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue allows remote authenticated users to bypass intended access restrictions via a modified request. This can be demonstrated by leveraging the support account to...
PT-2015-7493
Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue is related to an absolute path traversal vulnerability in the cgi-bin/webproc component. This allows remote attackers to read arbitrary files by providing a ful...
PT-2015-7495
Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the errorpage parameter in the cgi-bin/webproc endpoint...
