CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5403 – ASKEY 5G NR Small Cell - Command Injection
https://notcve.org/view.php?id=CVE-2024-5403
27 May 2024 — ASKEY 5G NR Small Cell fails to properly filter user input for certain functionality, allowing remote attackers with administrator privilege to execute arbitrary system commands on the remote server. ASKEY 5G NR Small Cell no logra filtrar adecuadamente la entrada del usuario para cierta funcionalidad, lo que permite a atacantes remotos con privilegios de administrador ejecutar comandos arbitrarios del sistema en el servidor remoto. • https://www.twcert.org.tw/tw/cp-132-7821-87e38-1.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-47040
https://notcve.org/view.php?id=CVE-2022-47040
24 Jan 2023 — An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a crafted file in the /tmp directory and sending crafted packets through port 80. Un problema en el router ASKEY RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 permite a los atacantes escalar privilegios ejecutando el comando tcpdump después de colocar un archivo manipulado en el directorio /tmp y enviar paquetes manipulados a través del puerto 80. • https://github.com/leoservalli/Privilege-escalation-ASKEY •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-28695
https://notcve.org/view.php?id=CVE-2020-28695
26 Mar 2021 — Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root. Los dispositivos Askey Fiber Router RTF3505VW-N1 versión BR_SV_g000_R3505VWN1001_s32_7, permiten una Ejecución de Código Remota y una recuperación de credenciales de administrador para iniciar sesión en el Panel o iniciar sesión por medio de SSH, conllevando a una ejecución del código como root. • https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2020-15023
https://notcve.org/view.php?id=CVE-2020-15023
11 Dec 2020 — Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random number selection for the Diffie-Hellman exchange. By capturing an attempted (and even failed) WPS authentication attempt, it is possible to brute force the overall authentication exchange. This allows an attacker to obtain the recovered WPS PIN in minutes or even seconds, and eventually obtain the Wi-Fi PSK key, gaining access to the Wi=Fi network. Los d... • https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d • CWE-330: Use of Insufficiently Random Values •
CVSS: 10.0EPSS: 11%CPEs: 2EXPL: 2CVE-2020-15357
https://notcve.org/view.php?id=CVE-2020-15357
11 Dec 2020 — Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to execute arbitrary commands via a shell metacharacter in the ping, traceroute, or route options. La funcionalidad Network Analysis en Askey versión AP5100W_Dual_SIG_1.01.097 y todas las versiones anteriores, permite a atacantes remotos ejecutar comandos arbitrarios por medio de un metacarácter shell en las opciones ping, traceroute o route • https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2020-26201
https://notcve.org/view.php?id=CVE-2020-26201
10 Dec 2020 — Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthorized access as an admin or root user to the device Operating System via Telnet or SSH. Askey AP5100W_Dual_SIG_1.01.097 y todas las versiones anteriores, utilizan una contraseña débil en el nivel del Sistema Operativo (rlx-linux). Esto permite que un atacante consiga acceso no autorizado como administrador o usuario root al Sistema Operativo del di... • https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d • CWE-521: Weak Password Requirements •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 1CVE-2020-8614
https://notcve.org/view.php?id=CVE-2020-8614
13 Feb 2020 — An issue was discovered on Askey AP4000W TDC_V1.01.003 devices. An attacker can perform Remote Code Execution (RCE) by sending a specially crafted network packer to the bd_svr service listening on TCP port 54188. Se detectó un problema en los dispositivos Askey AP4000W versión TDC_V1.01.003. Un atacante puede llevar a cabo una Ejecución de Código Remota (RCE) mediante el envío de un empaquetador de red especialmente diseñado para el servicio bd_svr escuchando sobre el puerto TCP 54188. • https://improsec.com/tech-blog/RCE-Askey • CWE-20: Improper Input Validation •