PatchTheCVEhongdian vulnerabilities
Recent CVEs affecting hongdian products. 10 tracked.
hongdian has 10 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 10. Most recent: 2024-01-12. Highest priority: CVE-2023-49255 (score 53/100).
- CVE-2023-49262 CRITICAL 9.8 UPGRADE The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, pr
- CVE-2023-49261 HIGH 7.5 UPGRADE The "tokenKey" value used in user authorization is visible in the HTML source of the login page.
- CVE-2023-49260 MEDIUM 6.1 UPGRADE An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi"
- CVE-2023-49259 HIGH 7.5 UPGRADE The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up
- CVE-2023-49258 MEDIUM 6.1 UPGRADE User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging
- CVE-2023-49257 HIGH 8.8 UPGRADE An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility
- CVE-2023-49256 HIGH 7.5 UPGRADE It is possible to download the configuration backup without authorization and decrypt included passwords using
- CVE-2023-49255 CRITICAL 9.8 UPGRADE The router console is accessible without authentication at "data" field, and while a user needs to be logged i
- CVE-2023-49254 HIGH 8.8 UPGRADE Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the
- CVE-2023-49253 CRITICAL 9.8 UPGRADE Root user password is hardcoded into the device and cannot be changed in the user interface.
FAQ
How do I fix hongdian vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is hongdian being exploited right now?
None of the tracked hongdian CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which hongdian CVE should I patch first?
CVE-2023-49255 currently ranks highest (53/100): The router console is accessible without authentication at "data" field, and while a user needs to be logged i.