netis-systems Archives - CVE Vulnerability

CVE-2018-6391

Sun, 26 Feb 2023 06:50:42 +0000

A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation List settings.

The post CVE-2018-6391 appeared first on CVE Vulnerability.

CVE-2018-6190

Sun, 26 Feb 2023 06:50:37 +0000

Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.

The post CVE-2018-6190 appeared first on CVE Vulnerability.

CVE-2018-5967

Sun, 26 Feb 2023 06:50:31 +0000

Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page.

The post CVE-2018-5967 appeared first on CVE Vulnerability.

CVE-2018-25069

Sun, 26 Feb 2023 06:49:06 +0000

A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability.

The post CVE-2018-25069 appeared first on CVE Vulnerability.

CVE-2020-8946

Sun, 26 Feb 2023 06:43:35 +0000

Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter.

The post CVE-2020-8946 appeared first on CVE Vulnerability.

CVE-2019-8985

Sun, 26 Feb 2023 06:34:48 +0000

On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP “Authorization: Basic” header that is mishandled by user_auth->user_ok in /bin/boa.

The post CVE-2019-8985 appeared first on CVE Vulnerability.

CVE-2019-20074

Sun, 26 Feb 2023 06:32:18 +0000

On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page.

The post CVE-2019-20074 appeared first on CVE Vulnerability.

CVE-2019-20076

Sun, 26 Feb 2023 06:32:18 +0000

On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).

The post CVE-2019-20076 appeared first on CVE Vulnerability.

CVE-2019-20075

Sun, 26 Feb 2023 06:32:18 +0000

On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).

The post CVE-2019-20075 appeared first on CVE Vulnerability.

CVE-2019-20073

Sun, 26 Feb 2023 06:32:18 +0000

On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).

The post CVE-2019-20073 appeared first on CVE Vulnerability.