CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-47040
https://notcve.org/view.php?id=CVE-2022-47040
An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a crafted file in the /tmp directory and sending crafted packets through port 80. Un problema en el router ASKEY RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 permite a los atacantes escalar privilegios ejecutando el comando tcpdump después de colocar un archivo manipulado en el directorio /tmp y enviar paquetes manipulados a través del puerto 80. • https://github.com/leoservalli/Privilege-escalation-ASKEY •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-28695
https://notcve.org/view.php?id=CVE-2020-28695
Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root. Los dispositivos Askey Fiber Router RTF3505VW-N1 versión BR_SV_g000_R3505VWN1001_s32_7, permiten una Ejecución de Código Remota y una recuperación de credenciales de administrador para iniciar sesión en el Panel o iniciar sesión por medio de SSH, conllevando a una ejecución del código como root. • https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2020-15023
https://notcve.org/view.php?id=CVE-2020-15023
Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random number selection for the Diffie-Hellman exchange. By capturing an attempted (and even failed) WPS authentication attempt, it is possible to brute force the overall authentication exchange. This allows an attacker to obtain the recovered WPS PIN in minutes or even seconds, and eventually obtain the Wi-Fi PSK key, gaining access to the Wi=Fi network. Los dispositivos Askey AP5100W versiones hasta AP5100W_Dual_SIG_1.01.097 están afectados por un descifrado de fuerza bruta fuera de línea WPS PIN. • https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d https://www.askey.com.tw/Products/wifi.html https://www.askey.com.tw/incident_report_notifications.html • CWE-330: Use of Insufficiently Random Values •
CVSS: 10.0EPSS: 3%CPEs: 2EXPL: 2CVE-2020-15357
https://notcve.org/view.php?id=CVE-2020-15357
Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to execute arbitrary commands via a shell metacharacter in the ping, traceroute, or route options. La funcionalidad Network Analysis en Askey versión AP5100W_Dual_SIG_1.01.097 y todas las versiones anteriores, permite a atacantes remotos ejecutar comandos arbitrarios por medio de un metacarácter shell en las opciones ping, traceroute o route • https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d https://starlabs.sg/advisories https://www.askey.com.tw/incident_report_notifications.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2020-26201
https://notcve.org/view.php?id=CVE-2020-26201
Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthorized access as an admin or root user to the device Operating System via Telnet or SSH. Askey AP5100W_Dual_SIG_1.01.097 y todas las versiones anteriores, utilizan una contraseña débil en el nivel del Sistema Operativo (rlx-linux). Esto permite que un atacante consiga acceso no autorizado como administrador o usuario root al Sistema Operativo del dispositivo por medio de Telnet o SSH. • https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d https://www.askey.com.tw https://www.askey.com.tw/incident_report_notifications.html • CWE-521: Weak Password Requirements •