Chuya Hayakawa

An OS command injection flaw exists in the Yamaha wireless LAN router NWR100. This issue allows an attacker to execute arbitrary operating system commands by sending a specially crafted request to the device.

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.

An authenticated command injection allows an administrator to execute arbitrary system commands through the web management interface. By using the browser developer console, a crafted input can be supplied that is passed to backend system commands without adequate sanitization. Successful exploitation enables the execution of commands with elevated privileges, potentially allowing the attacker to start unauthorized services, modify system configuration, or fully compromise the router operating environment.

A path traversal flaw exists in NEC Platforms, Ltd. Aterm Series, potentially allowing an attacker to overwrite any file through network access.

An OS Command Injection issue exists in NEC Platforms, Ltd. Aterm Series. This allows a malicious actor to execute arbitrary OS commands through the network.

A hidden functionality exists in NEC Platforms, Ltd. Aterm Series that allows an attacker to enable telnet access via the network.

An OS Command Injection issue exists in NEC Platforms, Ltd. Aterm Series. This allows a malicious actor to execute arbitrary OS commands through the network.

A hard-coded credentials issue exists in the software, potentially allowing an attacker to gain administrative access.

An authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device configuration.

A code injection issue exists in MR-GM5L-S1 and MR-GM5A-L1. Successful exploitation of this issue may allow an attacker with administrative privileges to execute arbitrary commands.

A command injection issue exists in the admin interface component. Authenticated attackers can execute system commands with a limited character length through crafted input in the browser developer console, potentially causing service disruption or full system compromise. The vulnerability is present when interacting with the admin interface. The vulnerable component allows execution of commands via the browser console.

An authentication bypass issue exists that may allow an attacker to bypass administrator authentication and change the password.

The RG-AP180, an indoor wall plate wireless AP, contains an OS command injection issue. An attacker who gains access to the CLI service can execute arbitrary OS commands on the device. The vulnerability allows for the execution of commands through the CLI service.

A hidden functionality issue exists that may allow a remote authenticated attacker to enable SSH access.

An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A remote authenticated attacker may be able to execute arbitrary OS commands.

Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information issue. Exploitation may lead to the disclosure of configuration information, such as admin passwords.

Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. Exploitation may allow an arbitrary OS command to be executed and sensitive information to be obtained.

Name of the Vulnerable Software and Affected Versions: TB-eye network recorders and AHD recorders (affected versions not specified) Description: A buffer overflow issue exists in the affected devices. The CGI process may terminate abnormally when processing a specially crafted request. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TB-eye network recorders (affected versions not specified) AHD recorders (affected versions not specified) Description: A problem of injection of system operating system commands exists in the mentioned devices. If this issue is exploited, an attacker who logs in to the device could execute an arbitrary system command. Recommendations: For TB-eye network recorders, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For AHD recorders, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WRH-733GBK and WRH-733GWH (affected versions not specified) Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection', in the telnet function. A remote unauthenticated attacker can send a specially crafted request to execute an arbitrary OS command. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.