rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-27091 RPC Endpoint Mapper Service Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 7
cpes: cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:x86:*
vendor: Microsoft
product: Windows 7 Service Pack 1
cpes: cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
cpes: cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012
cpes: cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2021-04-13T19:32:42.000Z
CVE-2021-27092 Azure AD Web Sign-in Security Feature Bypass Vulnerability
Problem types: description: Security Feature Bypass
Affected products: vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:*:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1803
cpes: cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server, version 1909 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-04-13T19:32:42.000Z
CVE-2021-27094 Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
Problem types: description: Security Feature Bypass
Affected products: vendor: Microsoft
product: Windows 10 Version 1803
cpes: cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server, version 1909 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:*:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1507
cpes: cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 1607
cpes: cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2016
cpes: cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 8.1
cpes: cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2012
cpes: cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 R2
cpes: cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
Published: 2021-04-13T19:32:44.000Z
CVE-2021-27097 
The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R
version: 3.1
Published: 2021-02-17T22:36:30.000Z
CVE-2021-27098 
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-05T16:59:06.000Z
CVE-2021-27099 
In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID templating feature, which may allow the issuance of an arbitrary SPIFFE ID within the same trust domain, if the attacker controls the value of an EC2 tag prior to attestation, and the attestor is configured for agent ID templating where the tag value is the last element in the path. This issue has been fixed in SPIRE versions 0.11.3 and 0.12.1
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-05T17:04:20.000Z
CVE-2021-27101 
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T20:02:39.000Z
CVE-2021-27102 
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T20:07:45.000Z
CVE-2021-27103 
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T20:12:12.000Z
CVE-2021-27104 
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T20:16:42.000Z
CVE-2021-27112 
LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-15T15:05:42.000Z
CVE-2021-27113 
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:53:39.000Z
CVE-2021-27114 
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'s_ip" and "s_mac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:54:04.000Z
CVE-2021-27116 
An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N
version: 3.1
Published: 2022-04-05T15:36:55.000Z
CVE-2021-27117 
An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N
version: 3.1
Published: 2022-04-05T15:36:37.000Z
CVE-2021-27124 
SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database credentials via a SQL injection attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-18T03:06:44.000Z
CVE-2021-27129 
CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-15T11:15:34.000Z
CVE-2021-27130 
Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T14:59:13.000Z
CVE-2021-27131 
Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer. NOTE: this is disputed by the vendor because the "Additional HTML Section" for "Header and Footer" can only be supplied by an administrator, who is intentionally allowed to enter unsanitized input (e.g., site-specific JavaScript).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-16T00:00:00.000Z
CVE-2021-27132 
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-27T05:01:02.000Z
CVE-2021-27135 
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T15:51:16.000Z
CVE-2021-27138 
The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R
version: 3.1
Published: 2021-02-17T22:36:52.000Z
CVE-2021-27139 
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to extract information from the device without authentication by disabling JavaScript and visiting /info.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:41:19.000Z
CVE-2021-27140 
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to find passwords and authentication cookies stored in cleartext in the web.log HTTP logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:41:08.000Z
CVE-2021-27141 
An issue was discovered on FiberHome HG6245D devices through RP2613. Credentials in /fhconf/umconfig.txt are obfuscated via XOR with the hardcoded *j7a(L#yZ98sSd5HfSgGjMj8;Ss;d)(*&^#@$a2s0i3g key. (The webs binary has details on how XOR is used.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:40:55.000Z
CVE-2021-27142 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:40:42.000Z
CVE-2021-27143 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / user1234 credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:40:31.000Z
CVE-2021-27144 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:40:22.000Z
CVE-2021-27145 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / lnadmin credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:40:07.000Z
CVE-2021-27146 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:40:00.000Z
CVE-2021-27147 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / admin credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:39:51.000Z
CVE-2021-27148 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded telecomadmin / nE7jA%5m credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:39:43.000Z
CVE-2021-27149 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:39:36.000Z
CVE-2021-27150 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded gestiontelebucaramanga / t3l3buc4r4m4ng42013 credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:39:26.000Z
CVE-2021-27151 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded rootmet / m3tr0r00t credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:39:02.000Z
CVE-2021-27152 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded awnfibre / fibre@dm!n credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:38:51.000Z
CVE-2021-27153 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded trueadmin / admintrue credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:38:42.000Z
CVE-2021-27154 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / G0R2U1P2ag credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:38:22.000Z
CVE-2021-27155 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 3UJUh2VemEfUtesEchEC2d2e credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:38:14.000Z
CVE-2021-27156 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains credentials for an ISP that equal the last part of the MAC address of the br0 interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:38:06.000Z
CVE-2021-27157 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 888888 credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:37:54.000Z
CVE-2021-27158 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded L1vt1m4eng / 888888 credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:37:47.000Z
CVE-2021-27159 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded useradmin / 888888 credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:37:38.000Z
CVE-2021-27160 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / 888888 credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:37:28.000Z
CVE-2021-27161 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 1234 credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:37:20.000Z
CVE-2021-27162 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:37:12.000Z
CVE-2021-27163 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / tele1234 credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:37:02.000Z
CVE-2021-27164 
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / aisadmin credentials for an ISP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:36:54.000Z
CVE-2021-27165 
An issue was discovered on FiberHome HG6245D devices through RP2613. The telnet daemon on port 23/tcp can be abused with the gpon/gpon credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:36:42.000Z
CVE-2021-27166 
An issue was discovered on FiberHome HG6245D devices through RP2613. The password for the enable command is gpon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:36:31.000Z
CVE-2021-27167 
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a password of four hexadecimal characters for the admin account. These characters are generated in init_3bb_password in libci_adaptation_layer.so.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:36:20.000Z
CVE-2021-27168 
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a 6GFJdY4aAuUKJjdtSn7d password for the rdsadmin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:36:09.000Z
CVE-2021-27169 
An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631. There is a gepon password for the gepon account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:35:59.000Z
CVE-2021-27170 
An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to the Internet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:35:48.000Z
CVE-2021-27171 
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to start a Linux telnetd as root on port 26/tcp by using the CLI interface commands of ddd and shell (or tshell).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:35:36.000Z
CVE-2021-27172 
An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:35:20.000Z
CVE-2021-27173 
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a telnet?enable=0&key=calculated(BR0_MAC) backdoor API, without authentication, provided by the HTTP server. This will remove firewall rules and allow an attacker to reach the telnet server (used for the CLI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T18:35:09.000Z