Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (18 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-25125 1 Netis-systems 1 Dl4322d 2026-04-15 N/A
Netis ADSL Router DL4322D firmware RTK 2.1.1 contains a buffer overflow vulnerability in the embedded FTP service that allows an authenticated remote user to trigger a denial of service. After logging in to the FTP service, sending an FTP command such as ABOR with an excessively long argument causes the service, and in practice the router, to crash or become unresponsive, resulting in a loss of availability for the device and connected users.
CVE-2020-37093 1 Netis-systems 1 Netis E1+ 2026-04-15 7.5 High
Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve WiFi passwords through the netcore_get.cgi endpoint. Attackers can send a GET request to the endpoint to extract sensitive network credentials including SSID and WiFi passwords in plain text.
CVE-2020-37092 1 Netis-systems 1 Netis E1+ 2026-04-15 7.5 High
Netis E1+ version 1.2.32533 contains a hardcoded root account vulnerability that allows unauthenticated attackers to access the device with predefined credentials. Attackers can leverage the embedded root account with a crackable password to gain full administrative access to the network device.
CVE-2019-19356 1 Netis-systems 2 Wf2419, Wf2419 Firmware 2025-11-07 7.5 High
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.
CVE-2018-25069 1 Netis-systems 2 Netcore Router, Netcore Router Firmware 2024-11-25 7.3 High
A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability.
CVE-2021-26747 1 Netis-systems 4 Wf2411, Wf2411 Firmware, Wf2780 and 1 more 2024-11-21 9.8 Critical
Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution.
CVE-2020-8946 1 Netis-systems 2 Wf2471, Wf2471 Firmware 2024-11-21 8.8 High
Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter.
CVE-2019-8985 1 Netis-systems 4 Wf2411, Wf2411 Firmware, Wf2880 and 1 more 2024-11-21 N/A
On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa.
CVE-2019-20076 1 Netis-systems 2 Dl4343, Dl4343 Firmware 2024-11-21 6.1 Medium
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).
CVE-2019-20075 1 Netis-systems 2 Dl4343, Dl4343 Firmware 2024-11-21 6.1 Medium
On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).
CVE-2019-20074 1 Netis-systems 2 Dl4343, Dl4343 Firmware 2024-11-21 8.8 High
On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page.
CVE-2019-20073 1 Netis-systems 2 Dl4343, Dl4343 Firmware 2024-11-21 6.1 Medium
On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).
CVE-2019-20072 1 Netis-systems 2 Dl4343, Dl4343 Firmware 2024-11-21 6.1 Medium
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration).
CVE-2019-20071 1 Netis-systems 2 Dl4343, Dl4343 Firmware 2024-11-21 6.5 Medium
On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs.
CVE-2019-20070 1 Netis-systems 2 Dl4343, Dl4343 Firmware 2024-11-21 6.1 Medium
On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration).
CVE-2018-6391 1 Netis-systems 2 Wf2419, Wf2419 Firmware 2024-11-21 N/A
A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation List settings.
CVE-2018-6190 1 Netis-systems 2 Wf2419, Wf2419 Firmware 2024-11-21 N/A
Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.
CVE-2018-5967 1 Netis-systems 2 Wf2419, Wf2419 Firmware 2024-11-21 N/A
Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page.