Filtered by vendor Hongdian Subscriptions
Filtered by product H8922 Firmware Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-28151 1 Hongdian 2 H8922, H8922 Firmware 2024-08-03 8.8 High
Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the username guest and password guest.
CVE-2021-28150 1 Hongdian 2 H8922, H8922 Firmware 2024-08-03 5.5 Medium
Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via /backup2.cgi.
CVE-2021-28149 1 Hongdian 2 H8922, H8922 Firmware 2024-08-03 6.5 Medium
Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file.
CVE-2021-28152 1 Hongdian 2 H8922, H8922 Firmware 2024-08-03 9.8 Critical
Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is used on port 5188 with the default credentials of root:superzxmn.