Tim Herres

The issue concerns a hardcoded guest account in the affected devices, allowing remote attackers to gain web-server login access.

The issue allows remote authenticated users to execute arbitrary commands. This is achieved by leveraging guest access and placing shell metacharacters in the query string of the 'cgi-bin/pingping.cgi' endpoint.

A cross-site request forgery (CSRF) issue affects the cgi-bin/create user.cgi endpoint, allowing remote attackers to hijack administrator authentication for creating administrative accounts via a NEW USER action.