Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2021-4470

TG8 Firewall Unauthenticated RCE via runphpcmd.php

TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is passed directly to a system command without validation and executed with root privileges. A remote, unauthenticated attacker can supply crafted values to execute arbitrary operating system commands as root, resulting in full device compromise.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Tg8 Togrow
Products
Tg8 Firewall Tg8 Firewall
CVE-2021-4471

TG8 Firewall Unauthenticated User Password Disclosure

TG8 Firewall exposes a directory such as /data/ over HTTP without authentication. This directory stores credential files for previously logged-in users. A remote unauthenticated attacker can enumerate and download files within the directory to obtain valid account usernames and passwords, leading to loss of confidentiality and further unauthorized access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tg8 Togrow
Products
Tg8 Firewall Tg8 Firewall