Netis Systems vulnerabilities, page 3
51 vulnerabilities
Known vulnerabilities in Netis Systems products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.
RoutineCVE-2019-20070netis-systems · dl4343_firmwarenetis-systems dl4343_firmwareOn Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration).CVSS6.1MediumEPSS1.44%RoutineCVE-2019-20071netis-systems · dl4343_firmwarenetis-systems dl4343_firmwareOn Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs.CVSS6.5MediumEPSS0.77%RoutineCVE-2019-20072netis-systems · dl4343_firmwarenetis-systems dl4343_firmwareOn Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration).CVSS6.1MediumEPSS1.53%RoutineCVE-2019-20073netis-systems · dl4343_firmwarenetis-systems dl4343_firmwareOn Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).CVSS6.1MediumEPSS1.78%RoutineCVE-2019-20074netis-systems · dl4343_firmwarenetis-systems dl4343_firmwareOn Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page.CVSS8.8HighEPSS1.40%RoutineCVE-2019-20075netis-systems · dl4343_firmwarenetis-systems dl4343_firmwareOn Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).CVSS6.1MediumEPSS1.78%RoutineCVE-2019-20076netis-systems · dl4343_firmwarenetis-systems dl4343_firmwareOn Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).CVSS6.1MediumEPSS1.53%PrioritiseCVE-2019-8985netis-systems · wf2411_firmware +1 morenetis-systems wf2411_firmwareOn Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa.CVSS9.8CriticalEPSS13.30%PrioritiseCVE-2018-6391netis-systems · wf2419_firmwarenetis-systems wf2419_firmwareA cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation List settings.CVSS8.8HighEPSS0.95%RoutineCVE-2018-5967netis-systems · wf2419_firmwarenetis-systems wf2419_firmwareNetis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page.CVSS5.4MediumEPSS0.67%RoutineCVE-2018-6190netis-systems · wf2419_firmwarenetis-systems wf2419_firmwareNetis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.CVSS5.4MediumEPSS1.58%