openwrt openwrt 19.07.0 vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

uhttpd in OpenWrt up to and including 18.06.5 and 19.x up to and including 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap buffer and a subsequent crash. It can be triggered with an HTTP POST request to a CGI script, specifying both "...

Openwrt Openwrt 19.07.0 Openwrt Openwrt

2 Github repositories

7.5

CVSSv3

libubox in OpenWrt prior to 18.06.7 and 19.x prior to 19.07.1 has a tagged binary data JSON serialization vulnerability that may cause a stack based buffer overflow.

Openwrt Openwrt Openwrt Openwrt 19.07.0

8.1

CVSSv3

An issue exists in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager prior to 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle malicious user to ...

Openwrt Lede Openwrt Openwrt Openwrt Openwrt 19.07.0

1 Github repository

7.2

CVSSv3

In wlan service, there is a possible command injection due to improper input validation. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00244189; Issue ID: WCNCR00244189.

Openwrt Openwrt 19.07.0 Openwrt Openwrt 21.02.0

8.8

CVSSv3

applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.

Openwrt Openwrt 19.07.0

5.4

CVSSv3

A stored cross-site scripting (XSS) vulnerability exists in the Web Interface for OpenWRT LuCI version 19.07 which allows malicious users to inject arbitrary Javascript in the OpenWRT Hostname via the Hostname Change operation.

Openwrt Openwrt 19.07.0

6.7

CVSSv3

In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07734012 / ALPS07874363 (For MT6880, MT689...

Google Android 13.0 Openwrt Openwrt 19.07.0 Openwrt Openwrt 21.02.0

6.7

CVSSv3

In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07856356 / ALPS07874388 (For MT6880 and MT...

Google Android 13.0 Openwrt Openwrt 19.07.0 Openwrt Openwrt 21.02.0

6.7

CVSSv3

In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07733998 / ALPS07874388 (For MT6880 and MT...

Google Android 12.0 Google Android 13.0 Openwrt Openwrt 19.07.0 Openwrt Openwrt 21.02.0

6.7

CVSSv3

In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local esclation of privileges with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017365; Issue ID: ALPS08017365.

Linuxfoundation Yocto 2.6 Google Android 13.0 Openwrt Openwrt 19.07.0 Openwrt Openwrt 21.02.0

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook