Vulnerability-Lookup - Search a vulnerability

Vulnerability from fkie_nvd

Published

2020-01-09 13:15

Modified

2024-11-21 04:34

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11.

References

URL	Tags
cve@mitre.org	https://cablehaunt.com	Exploit, Technical Description, Third Party Advisory
cve@mitre.org	https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf	Technical Description, Third Party Advisory
cve@mitre.org	https://github.com/Lyrebirds/Fast8690-exploit	Exploit, Third Party Advisory
cve@mitre.org	https://www.broadcom.com	Product
af854a3a-2127-422b-91ae-364da2661108	https://cablehaunt.com	Exploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf	Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/Lyrebirds/Fast8690-exploit	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.broadcom.com	Product

Impacted products

Vendor	Product	Version
sagemcom	f\@st_3890_firmware	*
sagemcom	f\@st_3890	-
sagemcom	f\@st_3890_firmware	*
sagemcom	f\@st_3890	-
sagemcom	f\@st_3686_firmware	3.428.0
sagemcom	f\@st_3686_firmware	4.83.0
sagemcom	f\@st_3686	-
netgear	cg3700emr_firmware	2.01.03
netgear	cg3700emr_firmware	2.01.05
netgear	cg3700emr	-
netgear	c6250emr_firmware	2.01.03
netgear	c6250emr_firmware	2.01.05
netgear	c6250emr	-
technicolor	tc7230_steb_firmware	01.25
technicolor	tc7230_steb	-
compal	7284e_firmware	5.510.5.11
compal	7284e	-
compal	7486e_firmware	5.510.5.11
compal	7486e	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sagemcom:f\\@st_3890_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A7AB5C0-0032-4E94-8342-619A862DF1E9",
              "versionEndExcluding": "50.10.21_t4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sagemcom:f\\@st_3890:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B00CCDB-BE96-4A31-A69F-B9EA68F0A906",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sagemcom:f\\@st_3890_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2AB87EC4-B19E-4627-82BE-41AE08B23D0B",
              "versionEndExcluding": "05.76.6.3f",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sagemcom:f\\@st_3890:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B00CCDB-BE96-4A31-A69F-B9EA68F0A906",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sagemcom:f\\@st_3686_firmware:3.428.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "49952BF0-03EA-43DC-AB32-B45C72328F52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sagemcom:f\\@st_3686_firmware:4.83.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E62AC3BC-8A2E-419D-9D3D-E2B00D0BB4A6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sagemcom:f\\@st_3686:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3466ACB1-D6DA-4CB7-A176-F16A47000AC1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netgear:cg3700emr_firmware:2.01.03:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0936804-9338-4510-8AD9-264ED8C487CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:netgear:cg3700emr_firmware:2.01.05:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE2D88A3-C2DD-4A8B-9C3D-DBFC779D20EA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netgear:cg3700emr:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBD36E99-0FC3-4F4D-B9E2-D4275CFC646E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netgear:c6250emr_firmware:2.01.03:*:*:*:*:*:*:*",
              "matchCriteriaId": "1ADE11A3-FAEA-40B3-B0D3-22F0C1012DA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:netgear:c6250emr_firmware:2.01.05:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F9A3B13-E948-423C-8F24-4A96221ABF83",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netgear:c6250emr:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "49BD2955-A719-4E9C-9120-733305B79B2A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:technicolor:tc7230_steb_firmware:01.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "635672C3-C386-43D5-9072-5EB90FCB32DD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:technicolor:tc7230_steb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F72BEB75-FE57-49AE-AD6B-61475FAE1D90",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:compal:7284e_firmware:5.510.5.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3BD2A00-3358-43BE-BB8C-8E71DA6EE79E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:compal:7284e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CDB29C72-EFDF-4682-A3D1-F618260F784D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:compal:7486e_firmware:5.510.5.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "2ED9CAC1-4018-4AB9-A66B-2498E2ADC11F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:compal:7486e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "11FF39D5-5827-4FE8-B546-C8863D535123",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim\u0027s browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11."
    },
    {
      "lang": "es",
      "value": "Los m\u00f3dems de cable basados en Broadcom mediante m\u00faltiples proveedores son vulnerables a un desbordamiento de b\u00fafer, lo que permite a un atacante remoto ejecutar c\u00f3digo arbitrario a nivel del kernel por medio de JavaScript ejecutado en el navegador de la v\u00edctima. Ejemplos de productos afectados incluyen Sagemcom F@st 3890 versiones anteriores a 50.10.21_T4, Sagemcom F@st 3890 versiones anteriores a 05.76.6.3f, Sagemcom F@st versi\u00f3n 3686 3.428.0, Sagemcom F@st versi\u00f3n 3686 4.83.0, NETGEAR CG3700EMR versi\u00f3n 2.01.05, NETGEAR CG3700EMR versi\u00f3n 2.01.03, NETGEAR C6250EMR versi\u00f3n 2.01.05, NETGEAR C6250EMR versi\u00f3n 2.01.03, Technicolor TC7230 STEB versi\u00f3n 01.25, COMPAL 7284E versi\u00f3n 5.510.5.11, and COMPAL 7486E versi\u00f3n 5.510.5.11."
    }
  ],
  "id": "CVE-2019-19494",
  "lastModified": "2024-11-21T04:34:50.037",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-01-09T13:15:10.993",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://cablehaunt.com"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Lyrebirds/Fast8690-exploit"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://www.broadcom.com"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://cablehaunt.com"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Lyrebirds/Fast8690-exploit"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://www.broadcom.com"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2024-03-14 13:15

Modified

2025-01-23 18:10

Severity ?

7.7 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.

References

▼	URL	Tags
	cve-coordination@incibe.es	https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router	Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router	Third Party Advisory

Impacted products

	Vendor	Product	Version
	sagemcom	f\@st_3686_firmware	*
	sagemcom	f\@st_3686	v2

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sagemcom:f\\@st_3686_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC4013B3-F95B-4BAA-9CEB-F5C35EAF4E8C",
              "versionEndExcluding": "3.709.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sagemcom:f\\@st_3686:v2:*:*:*:*:*:*:*",
              "matchCriteriaId": "15D79402-E870-47BD-BFA1-8E954CFFC066",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the \u0027Login.asp and logout.asp\u0027 files do not handle session details correctly."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de tiempo de espera de sesi\u00f3n insuficiente en el router Vodafone FAST3686 V2 de Sagemcom. Esta vulnerabilidad podr\u00eda permitir que un atacante local acceda al panel de administraci\u00f3n sin requerir credenciales de inicio de sesi\u00f3n. Esta vulnerabilidad es posible porque los archivos \u0027Login.asp y logout.asp\u0027 no manejan correctamente los detalles de la sesi\u00f3n."
    }
  ],
  "id": "CVE-2024-1623",
  "lastModified": "2025-01-23T18:10:39.310",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.2,
        "source": "cve-coordination@incibe.es",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-03-14T13:15:53.397",
  "references": [
    {
      "source": "cve-coordination@incibe.es",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router"
    }
  ],
  "sourceIdentifier": "cve-coordination@incibe.es",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "cve-coordination@incibe.es",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2021-01-26 18:16

Modified

2024-11-21 06:21

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI.

References

▼	URL	Tags
	cve@mitre.org	https://twitter.com/j0nh4t/status/1349649975479840769	Exploit, Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://twitter.com/j0nh4t/status/1349649975479840769	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	sagemcom	f\@st_3686_firmware	3.495
	sagemcom	f\@st_3686	v2

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sagemcom:f\\@st_3686_firmware:3.495:*:*:*:*:*:*:*",
              "matchCriteriaId": "577790CF-28A3-4D32-A81B-B265736FE75D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sagemcom:f\\@st_3686:v2:*:*:*:*:*:*:*",
              "matchCriteriaId": "15D79402-E870-47BD-BFA1-8E954CFFC066",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI."
    },
    {
      "lang": "es",
      "value": "Los dispositivos Sagemcom F@ST 3686 versi\u00f3n v2 3.495, presentan un desbordamiento del b\u00fafer por medio de una clave de sesi\u00f3n larga para el URI goform/login"
    }
  ],
  "id": "CVE-2021-3304",
  "lastModified": "2024-11-21T06:21:14.647",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-01-26T18:16:29.880",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/j0nh4t/status/1349649975479840769"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/j0nh4t/status/1349649975479840769"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2020-09-14 12:15

Modified

2024-11-21 05:12

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.

References

URL	Tags
cve@mitre.org	http://sagemcom.com	Vendor Advisory
cve@mitre.org	http://sagemcomfst3686v10hun3970.com	Broken Link
cve@mitre.org	https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733	Exploit, Third Party Advisory
cve@mitre.org	https://github.com/Gr3gPr1est/BugReport/blob/master/SAGEM_F%40ST3686_v1.0_HUN_3.97.0_XSS_Vuln..pdf	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://sagemcom.com	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://sagemcomfst3686v10hun3970.com	Broken Link
af854a3a-2127-422b-91ae-364da2661108	https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/Gr3gPr1est/BugReport/blob/master/SAGEM_F%40ST3686_v1.0_HUN_3.97.0_XSS_Vuln..pdf	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	sagemcom	f\@st_3686_firmware	1.0_hun_3.97.0
	sagemcom	f\@st_3686	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sagemcom:f\\@st_3686_firmware:1.0_hun_3.97.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1572CDF-6427-490B-ABCC-427002894FC5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sagemcom:f\\@st_3686:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3466ACB1-D6DA-4CB7-A176-F16A47000AC1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp."
    },
    {
      "lang": "es",
      "value": "Sagemcom F@ST3686 versi\u00f3n v1.0 HUN 3.97.0, presenta una vulnerabilidad de tipo XSS por medio de los archivos RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp"
    }
  ],
  "id": "CVE-2020-21733",
  "lastModified": "2024-11-21T05:12:50.377",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-14T12:15:10.943",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://sagemcom.com"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://sagemcomfst3686v10hun3970.com"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/SAGEM_F%40ST3686_v1.0_HUN_3.97.0_XSS_Vuln..pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://sagemcom.com"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://sagemcomfst3686v10hun3970.com"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/SAGEM_F%40ST3686_v1.0_HUN_3.97.0_XSS_Vuln..pdf"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2019-19494 (GCVE-0-2019-19494)

Vulnerability from cvelistv5

Published

2020-01-09 12:11

Modified

2024-08-05 02:16

Severity ?

CWE

n/a

Summary

Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11.

References

▼	URL	Tags
	https://www.broadcom.com	x_refsource_MISC
	https://cablehaunt.com	x_refsource_MISC
	https://github.com/Lyrebirds/Fast8690-exploit	x_refsource_MISC
	https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:16:47.418Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.broadcom.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cablehaunt.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Lyrebirds/Fast8690-exploit"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim\u0027s browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-09T12:11:13",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.broadcom.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cablehaunt.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Lyrebirds/Fast8690-exploit"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-19494",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim\u0027s browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.broadcom.com",
              "refsource": "MISC",
              "url": "https://www.broadcom.com"
            },
            {
              "name": "https://cablehaunt.com",
              "refsource": "MISC",
              "url": "https://cablehaunt.com"
            },
            {
              "name": "https://github.com/Lyrebirds/Fast8690-exploit",
              "refsource": "MISC",
              "url": "https://github.com/Lyrebirds/Fast8690-exploit"
            },
            {
              "name": "https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf",
              "refsource": "MISC",
              "url": "https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-19494",
    "datePublished": "2020-01-09T12:11:13",
    "dateReserved": "2019-12-02T00:00:00",
    "dateUpdated": "2024-08-05T02:16:47.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-21733 (GCVE-0-2020-21733)

Vulnerability from cvelistv5

Published

2020-09-14 11:50

Modified

2024-08-04 14:30

Severity ?

CWE

n/a

Summary

Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.

References

▼	URL	Tags
	http://sagemcom.com	x_refsource_MISC
	http://sagemcomfst3686v10hun3970.com	x_refsource_MISC
	https://github.com/Gr3gPr1est/BugReport/blob/master/SAGEM_F%40ST3686_v1.0_HUN_3.97.0_XSS_Vuln..pdf	x_refsource_MISC
	https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T14:30:33.696Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://sagemcom.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://sagemcomfst3686v10hun3970.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/SAGEM_F%40ST3686_v1.0_HUN_3.97.0_XSS_Vuln..pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-14T11:50:29",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://sagemcom.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://sagemcomfst3686v10hun3970.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/SAGEM_F%40ST3686_v1.0_HUN_3.97.0_XSS_Vuln..pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-21733",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://sagemcom.com",
              "refsource": "MISC",
              "url": "http://sagemcom.com"
            },
            {
              "name": "http://sagemcomfst3686v10hun3970.com",
              "refsource": "MISC",
              "url": "http://sagemcomfst3686v10hun3970.com"
            },
            {
              "name": "https://github.com/Gr3gPr1est/BugReport/blob/master/SAGEM_F%40ST3686_v1.0_HUN_3.97.0_XSS_Vuln..pdf",
              "refsource": "MISC",
              "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/SAGEM_F%40ST3686_v1.0_HUN_3.97.0_XSS_Vuln..pdf"
            },
            {
              "name": "https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733",
              "refsource": "MISC",
              "url": "https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-21733",
    "datePublished": "2020-09-14T11:50:29",
    "dateReserved": "2020-08-13T00:00:00",
    "dateUpdated": "2024-08-04T14:30:33.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1623 (GCVE-0-2024-1623)

Vulnerability from cvelistv5

Published

2024-03-14 12:47

Modified

2024-08-28 18:19

Severity ?

7.7 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-613 - Insufficient Session Expiration

Summary

Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.

References

▼	URL	Tags
	https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router

Impacted products

	Vendor	Product	Version
	Sagemcom	FAST3686 V2 Vodafone	Version: 0 < FAST3686_ONO-SIP_3.709.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:48:21.920Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sagemcom:fast3686_v2_vodafone:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fast3686_v2_vodafone",
            "vendor": "sagemcom",
            "versions": [
              {
                "lessThan": "FAST3686_ONO-SIP_3.709.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1623",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-14T15:59:13.905872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-28T18:19:52.425Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FAST3686 V2 Vodafone",
          "vendor": "Sagemcom",
          "versions": [
            {
              "lessThan": "FAST3686_ONO-SIP_3.709.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Ut\u00f3n Amaya (m3n0sd0n4ld)"
        }
      ],
      "datePublic": "2024-03-14T11:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the \u0027Login.asp and logout.asp\u0027 files do not handle session details correctly."
            }
          ],
          "value": "Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the \u0027Login.asp and logout.asp\u0027 files do not handle session details correctly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-14T12:47:40.629Z",
        "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
        "shortName": "INCIBE"
      },
      "references": [
        {
          "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerability fixed in version FAST3686_ONO-SIP_3.709.2 (released in July 2023)."
            }
          ],
          "value": "Vulnerability fixed in version FAST3686_ONO-SIP_3.709.2 (released in July 2023)."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Insufficient session timeout vulnerability in Sagemcom router",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
    "assignerShortName": "INCIBE",
    "cveId": "CVE-2024-1623",
    "datePublished": "2024-03-14T12:47:40.629Z",
    "dateReserved": "2024-02-19T11:12:38.593Z",
    "dateUpdated": "2024-08-28T18:19:52.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3304 (GCVE-0-2021-3304)

Vulnerability from cvelistv5

Published

2021-01-26 06:05

Modified

2024-08-03 16:53

Severity ?

CWE

n/a

Summary

Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI.

References

▼	URL	Tags
	https://twitter.com/j0nh4t/status/1349649975479840769	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:53:16.567Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/j0nh4t/status/1349649975479840769"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-26T06:05:15",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/j0nh4t/status/1349649975479840769"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-3304",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://twitter.com/j0nh4t/status/1349649975479840769",
              "refsource": "MISC",
              "url": "https://twitter.com/j0nh4t/status/1349649975479840769"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-3304",
    "datePublished": "2021-01-26T06:05:15",
    "dateReserved": "2021-01-25T00:00:00",
    "dateUpdated": "2024-08-03T16:53:16.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerabilites related to sagemcom - f\@st_3686_firmware

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

CVE-2019-19494 (GCVE-0-2019-19494)

Vulnerability from cvelistv5

CVE-2020-21733 (GCVE-0-2020-21733)

Vulnerability from cvelistv5

CVE-2024-1623 (GCVE-0-2024-1623)

Vulnerability from cvelistv5

CVE-2021-3304 (GCVE-0-2021-3304)

Vulnerability from cvelistv5