Planex vulnerabilities
9 vulnerabilities
Known vulnerabilities in Planex products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 15 products.
Products
15- Cs Qr202 vulnerabilities
- Cs W50Hd2 vulnerabilities
- Mzk Mf300Hp22 vulnerabilities
- Brl 04Cw1 vulnerabilities
- Brl 04R1 vulnerabilities
- Brl 04Ur1 vulnerabilities
- Mzk Dp150N1 vulnerabilities
- Mzk Dp300N1 vulnerabilities
- Smacam Night Vision1 vulnerabilities
- Cs Qr100 vulnerabilities
- Cs Qr220 vulnerabilities
- Cs Qr2200 vulnerabilities
- Cs Qr3000 vulnerabilities
- Cs Wmv02G0 vulnerabilities
- Mzk Mf300N0 vulnerabilities
CVE-2013-6026alphanetworksvdsl_asl-55052+12
EPSS score7.68%
The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.CVE-2021-37289planexmzk-dp150n_firmwareEPSS score1.76%
Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp.CVE-2017-12574planexcs-w50hd_firmwareEPSS score1.80%
An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. A hardcoded credential "supervisor:dangerous" was injected into web authentication database "/.htpasswd" during booting process, which allows attackers to gain unauthorized access and control the device completely; the account can't be modified or deleted.CVE-2017-12573planexcs-w50hd_firmwareEPSS score3.14%
An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. The device has a command-injection vulnerability in the web management UI on NAS settings page "/cgi-bin/nasset.cgi". An attacker can send a crafted HTTP POST request to execute arbitrary code. Authentication is required before executing the attack.CVE-2017-12577planexcs-qr20_firmware+1EPSS score1.46%
An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password ("admin:password") is used in the Android application that allows attackers to use a hidden API URL "/goform/SystemCommand" to execute any command with root permission.CVE-2017-12576planexcs-qr20_firmwareEPSS score2.20%
An issue was discovered on the PLANEX CS-QR20 1.30. A hidden and undocumented management page allows an attacker to execute arbitrary code on the device when the user is authenticated. The management page was used for debugging purposes, once you login and access the page directly (/admin/system_command.asp), you can execute any command.CVE-2024-45372planex communications inc.mzk-dp300n+1EPSS score0.19%
MZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability. Viewing a malicious page while logging in to the web management page of the affected product may lead the user to perform unintended operations such as changing the login password, etc.CVE-2024-30219planex communications inc.mzk-mf300hp2+2EPSS score0.29%
Active debug code vulnerability exists in PLANEX COMMUNICATIONS wireless LAN routers. If a logged-in user who knows how to use the debug function accesses the device's management page, an unintended operation may be performed. Note that MZK-MF300N is no longer supported, therefore the update for this product is not provided.CVE-2024-30220planex communications inc.mzk-mf300hp2+2EPSS score1.01%
Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port. Note that MZK-MF300N is no longer supported, therefore the update for this product is not provided.