Vulnerabilities

TI-2021-18223 CVE-2021-41426 · GHSA-rp82-525p-h9xh

Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm.

LOW 39

Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0071 Published 2021-11-10 No fix listed CWE-352

TI-2021-18224 CVE-2021-41427 · GHSA-m8jf-cw8f-j8r5

Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi.

LOW 29

Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01079 Published 2021-11-10 No fix listed CWE-79

TI-2020-09785 CVE-2020-12246 · GHSA-hfjg-h7gm-7j9g

Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS…

MEDIUM 46

Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, the Nslookup nslookup_ipaddr parameter, or the Traceroute traceroute_ipaddr parame…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04899 Published 2020-04-29 No fix listed CWE-78

TI-2016-05628 CVE-2016-6564 · GHSA-cp5q-fwmj-pjgc

Access control flaw in Ragentek Android software

MEDIUM 40

Android devices with code from Ragentek contain a privileged binary that performs over-the-air (OTA) update checks.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.02625 Published 2018-07-13 No fix listed CWE-494

Vulnerabilities

Filters

Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm.

Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi.

Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS…

Access control flaw in Ragentek Android software