Stevenyu113228

Name of the Vulnerable Software and Affected Versions: DASAN GPON ONU H660WM H660WMR210825 Description: An incorrect access control issue exists in the `/cgi-bin/system diagnostic main.asp` component, potentially allowing attackers to access sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: DASAN GPON ONU H660WM H660WMR210825 (affected versions not specified) Description: DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. Attackers can exploit this vulnerability to gain unauthorized access to sensitive information and modify its configuration via the UPnP protocol on the WAN side without authentication. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Hitron CGNF-TWN version 3.1.1.43-TWN-pre3 Description: The telnet service in Hitron CGNF-TWN is susceptible to a command injection due to insufficient input validation in the telnet command handling mechanism. An attacker can inject arbitrary commands through the telnet interface, potentially leading to remote code execution (RCE) with the privileges of the telnet user and unauthorized access to system settings and sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: D-Link DSL-7740C version DSL7740C.V6.TR069.20211230 Description: An incorrect access control issue exists in the `DELT file.xgi` API endpoint of the D-Link DSL-7740C. This allows attackers to modify arbitrary settings within the device’s XML database, including the administrator’s password. Recommendations: Apply configuration changes to restrict access to the `DELT file.xgi` endpoint.

Name of the Vulnerable Software and Affected Versions: D-Link DSL-7740C version DSL7740C.V6.TR069.20211230 Description: The device uses insecure default credentials for the Administrator account, potentially allowing attackers to escalate privileges through a brute-force attack. Recommendations: Change the default password for the Administrator account.