CVSS: 3.4EPSS: 0%CPEs: 7EXPL: 0CVE-2023-38301
https://notcve.org/view.php?id=CVE-2023-38301
22 Apr 2024 — An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. Various software builds for the BLU View 2, Boost Mobile Celero 5G, Sharp Rouvo V, Motorola Moto G Pure, Motorola Moto G Power, T-Mobile Revvl 6 Pro 5G, and T-Mobile Revvl V+ 5G devices leak the device serial number to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from ... • https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2018-15003
https://notcve.org/view.php?id=CVE-2018-15003
25 Apr 2019 — The Coolpad Defiant (Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys) and the T-Mobile Revvl Plus (Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_02-206:user/release-keys) Android devices contain a pre-installed platform app with a package name of com.qualcomm.qti.telephony.extcarrierpack (versionCode=25, versionName=7.1.1) containing an exported broadcast receiver app component named com.qualcomm.qti.telephony.extcarrierpack.UiccReceiver that allows any app co-located on t... • https://www.kryptowire.com • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2018-14991
https://notcve.org/view.php?id=CVE-2018-14991
25 Apr 2019 — The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of co... • https://www.kryptowire.com • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2018-14990
https://notcve.org/view.php?id=CVE-2018-14990
25 Apr 2019 — The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of co... • https://www.kryptowire.com • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 90%CPEs: 5EXPL: 6CVE-2014-9583 – ASUSWRT 3.0.0.4.376_1071 - LAN Backdoor Command Execution
https://notcve.org/view.php?id=CVE-2014-9583
08 Jan 2015 — common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote attackers to bypass authentication and execute arbitrary commands via a NET_CMD_ID_MANU_CMD packet to UDP port 9999. NOTE: this issue was incorrectly mapped to CVE-2014-10000, but that ID is invalid due to its use as an example of the 2014 CVE ID syntax change. common.c en infosvr en... • https://packetstorm.news/files/id/147284 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 3CVE-2014-2718 – ASUS Router Man-In-The-Middle
https://notcve.org/view.php?id=CVE-2014-2718
29 Oct 2014 — ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the integrity of firmware (1) update information or (2) downloaded updates, which allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image. Los routers ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, y posiblemente otros de la serie RT anterior a firmware 3.0.0.4.37... • http://dnlongen.blogspot.com/2014/10/CVE-2014-2718-Asus-RT-MITM.html • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2014-6733
https://notcve.org/view.php?id=CVE-2014-6733
26 Sep 2014 — The My T-Mobile (aka at.tmobile.android.myt) application @7F0C0030 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. La aplicación My T-Mobile (también conocido como at.tmobile.android.myt) @7F0C0030 para Android no verifica los certificados X.509 de los servidores SSL, lo que permite a atacantes man-in-the-middle falsificar servidores y obtener información sensible a través d... • http://www.kb.cert.org/vuls/id/175057 • CWE-310: Cryptographic Issues •
CVSS: 8.8EPSS: 37%CPEs: 5EXPL: 2CVE-2013-5948 – Asus RT56U 3.0.0.4.360 - Remote Command Injection
https://notcve.org/view.php?id=CVE-2013-5948
21 Apr 2014 — The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field (destIP parameter). La etiqueta Network Analysis (Main_Analysis_Content.asp) en los routers ASUS RT-AC68U y otros series RT con firmware anterior a 3.0.0.4.374.5047 permite a usuarios remotos autenticados ejecutar comandos arbitrarios a través de metacaracteres d... • https://www.exploit-db.com/exploits/25998 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 2CVE-2014-2925
https://notcve.org/view.php?id=CVE-2014-2925
21 Apr 2014 — Cross-site scripting (XSS) vulnerability in Advanced_Wireless_Content.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the current_page parameter to apply.cgi. Vulnerabilidad de XSS en Advanced_Wireless_Content.asp en routers ASUS RT-AC68U y otros de la serie RT con firmware anterior a 3.0.0.4.374.5047 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través del parámetro current_page ... • http://seclists.org/fulldisclosure/2014/Apr/59 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 52EXPL: 1CVE-2014-2719 – ASUS RT Password Disclosure
https://notcve.org/view.php?id=CVE-2014-2719
17 Apr 2014 — Advanced_System_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code. Advanced_System_Content.asp en routers de la serie ASUS RT con firmware anterior a 3.0.0.4.374.5517, cuando una sesión de administrador está activa, permite a usuarios remotos autenticados obtener el nombre de usuario y contraseña del administrador mediante la ... • https://packetstorm.news/files/id/126213 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •