Mar 10

ZyXEL privilege escalation through micro_httpd web server

Vulnerability details — ZyXEL routers running the micro_httpd web server are affected by privilege escalation on the web interface due to an insufficient validation of user input. An authenticated user can create or edit an user on the administrator group by sending a specially crafted request to the /pages/tabFW/userAccount-cfg.cmd URI, changing de groupName…

Cve

3 min read

ZyXEL privilege escalation through micro_httpd web server

Mar 10

Zyxel sshd restricted shell escape

Vulnerability details — ZyXEL routers running the SSH-2.0-dropbear_0.46 are affected by restricted shell escape which isolate users on an interactive console with limited commands due to an insufficient validation of the user input by using substitution commands the attacker can execute commands with root privileges. Successfully tested on ZyXEL models VMG1312-B10A and VMG1312-B10B with firmware versions V1.00(AAJZ.17)C0 and V1.00(AAVS.0)b21.

Zyxel

2 min read

Zyxel sshd restricted shell escape

Vulnerability details

ZyXEL routers running the SSH-2.0-dropbear_0.46 are affected by restricted shell escape which isolate users on an interactive console with limited commands due to an insufficient validation of the user input by using substitution commands the attacker can execute commands with root privileges.

Successfully tested on ZyXEL models VMG1312-B10A and VMG1312-B10B with firmware versions V1.00(AAJZ.17)C0 and V1.00(AAVS.0)b21.

Mar 9

ZyXEL micro_httpd pre-auth RCE

Vulnerability details — ZyXEL routers running the micro_httpd web server are affected by a stack-based buffer overflow vulnerability due to insecure handling of memory in the getAuthInfoFromQuery function. An unauthenticated user can send a specially crafted request to the /login/login-page.cgi URI and gain remote code execution under the root user scope. Successfully tested…

Buffer Overflow

3 min read

Aug 19, 2021

CVE-2021–39474 : OS Command Injection on UBC1319 Router CPE

Ubee Interactive UBC1319 this is a DOCSIS 3.0 Advanced Wireless Voice Gateway delivers multi-gigabit speeds and integrates 4 products into a single device: a cable modem, a residential gateway with built-in four-port gigabit Ethernet switch, an 802.11ac dual-band concurrent Wi-Fi access point, and a 2-line multimedia terminal adapter for telephony. …

Os Command Injection

2 min read

ZyXEL privilege escalation through micro_httpd web server

Zyxel sshd restricted shell escape

Zyxel sshd restricted shell escape

Vulnerability details

ZyXEL micro_httpd pre-auth RCE

CVE-2021–39474 : OS Command Injection on UBC1319 Router CPE

Gabriel Romero