huzaifa hussain

15 exploits Active since Apr 2020
CVE-2020-23587 NOMISEC LOW WRITEUP
OPTILINK OP-XT71000N V2.2 OP_V3.3.1-191028 CSRF via Routing Config
A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to men in the middle attack by adding New Routes in RoutingConfiguration on " /routing.asp ".
1 stars
CVSS 3.1
CVE-2020-23586 NOMISEC MEDIUM WRITEUP
OPTILINK OP-XT71000N V2.2 Firmware OP_V3.3.1-191028 - Unauthenticated Cross-Site Request Forgery
A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Add Network Traffic Control Type Rule.
1 stars
CVSS 4.3
CVE-2019-17525 NOMISEC HIGH WRITEUP
D-Link DIR-615 T1 20.10 - Unauthenticated CAPTCHA Bypass via Login Page
The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.
1 stars
CVSS 8.8
CVE-2020-23584 NOMISEC CRITICAL WRITEUP
OPTILINK OP-XT71000N V2.2 - Unauthenticated Remote Code Execution via PingTest Parameter Command Injection
Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" parameter that leads to command execution.
CVSS 9.8
CVE-2020-23585 NOMISEC HIGH WRITEUP
OPTILINK OP-XT71000N V2.2 Firmware OP_V3.3.1-191028 - Cross-Site Request Forgery via mgm_config_file.asp
A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028. The vulnerability is due to insufficient CSRF protections for the "mgm_config_file.asp" because of which attacker can create a crafted "csrf form" which sends " malicious xml data" to "/boaform/admin/formMgmConfigUpload". the exploit allows attacker to "gain full privileges" and to "fully compromise of router & network".
CVSS 8.8
CVE-2020-23588 NOMISEC MEDIUM WRITEUP
OPTILINK OP-XT71000N V2.2 Firmware OP_V3.3.1-191028 - Unauthenticated Cross-Site Request Forgery via rmtacc.asp
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to "Enable or Disable Ports" and to "Change port number" through " /rmtacc.asp ".
CVSS 4.3
CVE-2020-23589 NOMISEC MEDIUM WRITEUP
OPTILINK OP-XT71000N V2.2 Firmware OP_V3.3.1-191028 - Unauthenticated Denial of Service via CSRF to Reboot Endpoint
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to cause a Denial of Service by Rebooting the router through " /mgm_dev_reboot.asp."
CVSS 6.5
CVE-2020-23590 NOMISEC MEDIUM WRITEUP
Optilink OP-XT71000N V2.2 Firmware OP_V3.3.1-191028 - Unauthenticated Cross-Site Request Forgery via wlwpa.asp
A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack to change the Password for "WLAN SSID" through "wlwpa.asp".
CVSS 6.5
CVE-2020-23591 NOMISEC CRITICAL WRITEUP
OPTILINK OP-XT71000N V2.2 - File Upload
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm_dev_upgrade.asp " which can "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor.
CVSS 9.8
CVE-2020-23593 NOMISEC MEDIUM WRITEUP
OPTILINK OP-XT71000N V2.2 Firmware OP_V3.3.1-191028 - Unauthenticated Cross-Site Request Forgery via mgm_log_cfg.asp
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross site request forgery (CSRF) attack to enable syslog mode through ' /mgm_log_cfg.asp.' The system starts to log events, 'Remote' mode or 'Both' mode on "Syslog -- Configuration page" logs events and sends to remote syslog server IP and Port.
CVSS 6.5
CVE-2020-23592 NOMISEC HIGH WRITEUP
OPTILINK OP-XT71000N V2.2 Firmware OP_V3.3.1-191028 - Unauthenticated Cross-Site Request Forgery via mgm_dev_reset.asp
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Reset ONU to Factory Default through ' /mgm_dev_reset.asp.' Resetting to default leads to Escalation of Privileges by logging-in with default credentials.
CVSS 8.8
CVE-2020-23582 NOMISEC MEDIUM WRITEUP
optilink OP-XT71000N V2.2 - Unauthenticated Cross-Site Request Forgery via wlmultipleap.asp
A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to create Multiple WLAN BSSID.
CVSS 6.5
CVE-2020-23583 NOMISEC CRITICAL WRITEUP
OPTILINK OP-XT71000N V2.2 - Remote Code Execution via PingTest Interface
OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.
CVSS 9.8
CVE-2019-17525 WRITEUP HIGH WRITEUP
D-Link DIR-615 T1 20.10 - Unauthenticated CAPTCHA Bypass via Login Page
The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.
CVSS 8.8
CVE-2019-17525 EXPLOITDB HIGH text WRITEUP
D-Link DIR-615 T1 20.10 - Unauthenticated CAPTCHA Bypass via Login Page
The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.
CVSS 8.8