CVE-2023-1389 : TP-LINK ARCHER AX21 PRIOR 1.1.4 BUILD 20230219 WEB MANAGEMENT INTERFACE LOCALE POPEN COUNTRY OS COMMAND INJECTION

Description

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

References

https://www.tenable.com/security/research/tra-2023-11

For More Information

MITRE

Contact us to get started

CVE-2023-1501 : ROCKOA 2.3.2 ACLOUDCOSACTION.PHP.SQL RUNACTION FILEID UNRESTRICTED UPLOAD

Description A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the

Learn more

CVE-2023-28116 : CONTIKI-NG UP TO 4.8/4.9 BLE L2CAP MODULE PACKETBUF_SIZE BUFFER OVERFLOW

Description Contiki-NG is an open-source, cross-platform operating system for internet of things (IoT) devices. In versions 4.8 and prior, an

Learn more

CVE-2023-1256 : AVEVA PLANT SCADA/TELEMETRY SERVER IMPROPER AUTHORIZATION

Description The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which

Learn more