The BEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely.
Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
The application suffers from an unauthenticated SQL Injection vulnerability. Input passed through 'input_id' POST parameter in '/http/index.php' is not properly sanitised before being returned to the user or used in SQL queries.
Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
The unknown exploit targets the login CGI script, where a key parameter is not properly sanitized leading to a command injection.
Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
vulnerabilities in the web-based management interface of OptiLink could allow an authenticated, remote attacker to perform command injection attacks against an affected device.
Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
NETGEAR decided to use to check if a page has “.jpg”, “.gif” or “ess_” substrings, trying to match the entire URL. We can therefore access any page on the device, including those that require authentication, by appending a GET variable with the relevant substring (like “?.gif”).
Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
The default password of this router is the last 8 characters of the
device's serial number which exist in the back of the device.
Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
Prince Chaddha
sandeep
GwanYeong Kim
Prince Chaddha
PikPikcU
Dhiyaneshwaran
sandeep