CVE Vulnerability

CWE-78

CVE-2018-13307

by

System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the “ntpServerIp2” POST parameter. Certain payloads cause the device to become permanently inoperable.

CVE-2018-13311

by

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the “sambaUser” POST parameter.

CVE-2018-13314

by

System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the “ipAddr” POST parameter.

CVE-2018-13316

by

System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the “subnet” POST parameter.

CVE-2018-13023

by

System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the “timeout” URL parameter.

CVE-2018-12972

by

An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.