Vulnerabilities

TI-2023-11812 CVE-2023-26866 · GHSA-738m-4w87-gpwc

GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1…

MEDIUM 53

GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02288 Published 2023-04-04 No fix listed CWE-77

TI-2018-10170 CVE-2018-14067 · GHSA-j52m-vhf5-m2h5

Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with…

MEDIUM 52

Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted payload to the HTTPS port, because lighttpd listens on all network interfaces (incl…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07316 Published 2020-12-31 No fix listed CWE-77

TI-2016-05616 CVE-2016-6552 · GHSA-6xxx-rh9w-rhw2

Green Packet DX-350 uses default credentials

MEDIUM 47

Green Packet DX-350 uses non-random default credentials of: root:wimax.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02842 Published 2018-07-13 No fix listed CWE-255

TI-2017-07339 CVE-2017-9980 · GHSA-7rpp-qvvp-3f22

In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the "PING" (aka…

MEDIUM 47

In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the "PING" (aka tag_ipPing) feature within the web interface allows performing command injection, via the "pip" parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02963 Published 2017-07-21 No fix listed CWE-77

TI-2017-07300 CVE-2017-9932 · GHSA-j39f-xq2j-78rc

Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account.

MEDIUM 45

Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01516 Published 2017-07-21 No fix listed CWE-798

TI-2017-07299 CVE-2017-9931 · GHSA-8m8p-545c-2rwc

Cross-Site Scripting (XSS) exists in Green Packet DX-350 Firmware version…

LOW 28

Cross-Site Scripting (XSS) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by the action parameter to ajax.cgi.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00652 Published 2017-07-21 No fix listed CWE-79

TI-2017-07298 CVE-2017-9930 · GHSA-cvhq-p97v-j237

Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version…

LOW 39

Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to ajax.cgi that enables UPnP.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00477 Published 2017-07-21 No fix listed CWE-352

TI-2017-02420 CVE-2017-3216 · GHSA-mf99-f92w-2rq5

Missing authentication in Huawei BM2022

MEDIUM 50

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by perform…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.05175 Published 2017-06-20 No fix listed CWE-306

Vulnerabilities

Filters