Sebastian Kraemer

The issue allows an attacker to make logged-in high-privilege users change settings and set Cross-Site Scripting payloads due to the lack of a CSRF check when saving settings and the failure to escape some settings when outputting them.

A directory traversal issue exists in the NC854 and NC856 modules, allowing remote authenticated users to read arbitrary files. This is possible via unspecified vectors involving an internal web server. For example, it can be used to read a TELNET credentials file.