CVE-2014-1406

CVE-2014-1406: CRLF injection in goform/formWlSiteSurvey on Conceptronic C54APM (runtime 1.26) allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via the submit-url parameter in a Refresh action. Documents identify the affected component and vulnerability...

CVE-2014-1407

CVE-2014-1407 affects the Conceptronic C54APM access point running code version 1.26. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via (1) the submit-url parameter in a Refresh action to goform/formW...

CVE-2014-1405

Conceptronic C54APM access point running firmware 1.26 is affected by multiple open redirect vulnerabilities. An attacker can trigger redirects to arbitrary sites via two parameters: submit-url in the Refresh action to goform/formWlSiteSurvey, and wlan-url in goform/formWlanSetup. Impact is phish...

CVE-2014-1408

The CVE-2014-1408 entry concerns the Conceptronic C54APM access point running code 1.26 that uses a default admin password, enabling remote access via HTTP and enabling stored XSS attacks. The vulnerability is tied to an insecure default credential in the admin account, exposing administrative co...