This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2023-49255 | BDVDB-2026-221920 Detail

HongdianH8951-4G-ESP

Description#

The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one. If the logged in user has administrative privileges, it is possible to use webadmin service configuration commands to create a new admin user with a chosen password.

Impact#

CAPEC-114 Authentication Abuse

Weaknesses#

  • CWE-306 Missing Authentication for Critical Function

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.