fcm-mb40_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/fcm-mb40_firmware/ Sun, 26 Feb 2023 06:30:14 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png fcm-mb40_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/fcm-mb40_firmware/ 32 32 CVE-2019-13398 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13398/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13398/ Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.

The post CVE-2019-13398 appeared first on CVE Vulnerability.

]]> Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.

The post CVE-2019-13398 appeared first on CVE Vulnerability.

]]> CVE-2019-13399 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13399/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13399/ Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator’s SSL conversation.

The post CVE-2019-13399 appeared first on CVE Vulnerability.

]]> Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator’s SSL conversation.

The post CVE-2019-13399 appeared first on CVE Vulnerability.

]]> CVE-2019-13400 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13400/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13400/ Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.

The post CVE-2019-13400 appeared first on CVE Vulnerability.

]]> Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.

The post CVE-2019-13400 appeared first on CVE Vulnerability.

]]> CVE-2019-13401 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13401/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13401/ Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.

The post CVE-2019-13401 appeared first on CVE Vulnerability.

]]> Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.

The post CVE-2019-13401 appeared first on CVE Vulnerability.

]]> CVE-2019-13402 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13402/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13402/ /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.

The post CVE-2019-13402 appeared first on CVE Vulnerability.

]]> /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.

The post CVE-2019-13402 appeared first on CVE Vulnerability.

]]>