If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges.Ī command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0b7_2). There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.Īn unauthorized command injection vulnerability exists in the ActionLogin function of the a file in Ikuai router OS through 3.7.1.ĭraytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. ** UNSUPPORTED WHEN ASSIGNED ** Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the url parameter at /start-apply.html. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. ** UNSUPPORTED WHEN ASSIGNED ** A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL Keyword List text field. ** UNSUPPORTED WHEN ASSIGNED ** Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html. directory traversal and do not ensure that an intended file extension (.csv or. Packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow.
0 kommentar(er)
