Priority MEDIUM 50
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00763 · Published 2024-01-10 · No fix listed CWE-121
Priority MEDIUM 50
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00763 · Published 2024-01-10 · No fix listed CWE-121
Priority MEDIUM 50
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00763 · Published 2024-01-10 · No fix listed CWE-121
Priority MEDIUM 50
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00763 · Published 2024-01-10 · No fix listed CWE-122
Priority MEDIUM 50
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00763 · Published 2024-01-10 · No fix listed CWE-121
Priority MEDIUM 50
The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00559 · Published 2024-01-10 · No fix listed CWE-798
Priority MEDIUM 50
The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00575 · Published 2024-01-10 · No fix listed CWE-798
Priority MEDIUM 49
The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00634 · Published 2024-01-10 · No fix listed CWE-862
Priority MEDIUM 48
The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00869 · Published 2024-01-10 · No fix listed CWE-89
Priority MEDIUM 48
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01088 · Published 2024-01-10 · No fix listed CWE-22
Priority MEDIUM 45
The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00541 · Published 2024-01-10 · No fix listed CWE-1391
Priority MEDIUM 41
The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00236 · Published 2024-01-10 · No fix listed CWE-352
Priority MEDIUM 41
The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00635 · Published 2024-01-10 · No fix listed CWE-285
Priority MEDIUM 40
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00622 · Published 2024-01-10 · No fix listed CWE-89
Priority MEDIUM 40
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00622 · Published 2024-01-10 · No fix listed CWE-89
Priority MEDIUM 40
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00622 · Published 2024-01-10 · No fix listed CWE-89
Priority MEDIUM 40
The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00562 · Published 2024-01-10 · No fix listed CWE-862
Priority LOW 37
The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP reque…
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00496 · Published 2024-01-10 · No fix listed CWE-79
Priority LOW 36
The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2024-01-10 · No fix listed CWE-22
Priority LOW 36
The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2024-01-10 · No fix listed CWE-22
Priority LOW 35
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00306 · Published 2024-01-10 · No fix listed CWE-79
Priority LOW 35
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00306 · Published 2024-01-10 · No fix listed CWE-79
Priority LOW 34
The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00302 · Published 2024-01-10 · No fix listed CWE-113
Priority LOW 31
The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP…
CVSS 3.1MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.00436 · Published 2024-01-10 · No fix listed CWE-79
Priority LOW 30
The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2024-01-10 · No fix listed CWE-22