EUVD-2020-29052

Malware in sbrugna...

CVE-2022-42176

In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access...

Hardcoded credentials

In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access...

CVE-2020-8168

AirMax AirOS v6.3.0 fixes a CSRF vulnerability in v6.2.0 and earlier on TI, XW and XM boards. The issue allowed CSRF-protected endpoints to be abused by authenticated users via malicious pages to perform actions such as downgrading firmware, modifying configuration, uploading firmware, and exfilt...

CVE-2020-8171

CVE-2020-8171 affects Ubiquiti AirMax AirOS firmware for TI, XW and XM boards (versions 6.2.0 and earlier). The issue is a command-injection vulnerability in certain endpoints where an input string can bypass filters and still execute commands, enabling remote code execution. The vulnerability is...

CVE-2020-8171

We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to...

CVE-2020-8170

The CVE-2020-8170 entry relates to Ubiquiti AirMax AirOS firmware (TI, XW, XM boards) with v6.2.0 and earlier, where multiple endpoints vulnerable to reflected XSS could allow an attacker to abuse a user’s session info and potentially take over the admin account. The vulnerability is tied to endp...

Ubiquiti Inc.: RCE in AirOS 6.2.0 Devices with CSRF bypass

There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution. These vulnerabilities can be also can be also paired with other e...

Ubiquiti Inc.: Reflected XSS in Nanostation Loco M2 - AirOS ver=6.1.7

AirMax XW.v6.2.0 and prior containing multiple end-points with parameters vulnerable to reflected cross site scripting XSS, allowing attackers to abuse the user' session information and/or account takeover of the admin user. These vulnerabilities were found on AirMax AirMax AirOS v6.2.0 and prior...