PatchTheCVEh8951-4g-esp firmware vulnerabilities and fixes
Recent CVEs affecting h8951-4g-esp firmware, with upgrade or downgrade steps. 10 tracked.
Also searched as: h8951 4g esp firmware, h8951-4g-espfirmware.
h8951-4g-esp firmware has 10 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 10. Most recent: 2024-01-12. Highest priority: CVE-2023-49255 (score 53/100).
- CVE-2023-49262 CRITICAL 9.8 UPGRADE The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, pr
- CVE-2023-49261 HIGH 7.5 UPGRADE The "tokenKey" value used in user authorization is visible in the HTML source of the login page.
- CVE-2023-49260 MEDIUM 6.1 UPGRADE An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi"
- CVE-2023-49259 HIGH 7.5 UPGRADE The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up
- CVE-2023-49258 MEDIUM 6.1 UPGRADE User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging
- CVE-2023-49257 HIGH 8.8 UPGRADE An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility
- CVE-2023-49256 HIGH 7.5 UPGRADE It is possible to download the configuration backup without authorization and decrypt included passwords using
- CVE-2023-49255 CRITICAL 9.8 UPGRADE The router console is accessible without authentication at "data" field, and while a user needs to be logged i
- CVE-2023-49254 HIGH 8.8 UPGRADE Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the
- CVE-2023-49253 CRITICAL 9.8 UPGRADE Root user password is hardcoded into the device and cannot be changed in the user interface.
FAQ
How do I fix h8951-4g-esp firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is h8951-4g-esp firmware being exploited right now?
None of the tracked h8951-4g-esp firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which h8951-4g-esp firmware CVE should I patch first?
CVE-2023-49255 currently ranks highest (53/100): The router console is accessible without authentication at "data" field, and while a user needs to be logged i.