Tenda N300 Authentication Bypass via Malformed HTTP Request Header

Free Trial

Tenda N300 Authentication Bypass via Malformed HTTP Request Header

http://koolkoncepts.com/air-conditioning/air-conditioning-replacement/ Overview :

Tenda N300 allows Authentication Bypass vuln through Malformed HTTP Request

http://smragan.com/category/design/page/2/ Affected Product(s) :

N300/N301 Router

Vulnerability Details :

CVE ID :

CVE-2020-35391

Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device’s HTTP response behavior.

Solution :

For downloading latest Firmware, check the company site

Contact us to get started

CVE-2024-45252 : ELSIGHT HALO PRIOR 11.9.4.0 OS COMMAND INJECTION

Description Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) References https://www.gov.il/en/Departments/faq/cve_advisories For

Learn more

CVE-2024-47350 : YITH WOOCOMMERCE AJAX SEARCH PLUGIN UP TO 2.8.0 ON WORDPRESS SQL INJECTION

Description Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in YITH YITH WooCommerce Ajax Search

Learn more

CVE-2024-9560 : ESAFENET CDG V5 CATELOGS;LOGINDOJOJS DELCATELOGS ID SQL INJECTION

Description A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is

Learn more