Vendor/product archive

mercusys / mercury_x18g CVEs

Beta · best-effort

4 CVEs tagged to mercusys / mercury_x18g — 0 Critical, 1 High, 3 Medium, 0 Low, 0 Unrated.

See this archive with more filters Back to mercusys vendor archive

CVE-2021-25811

Published Apr 29, 2021

MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is…

CVSS 7.5 · High

Vendor/product tagsBeta · best-effort

CVE-2021-25810

Published Apr 29, 2021

Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.

CVSS 6.1 · Medium

Vendor/product tagsBeta · best-effort

CVE-2021-23242

Published Jan 7, 2021

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI.

CVSS 5.3 · Medium

Vendor/product tagsBeta · best-effort

CVE-2021-23241

Published Jan 7, 2021

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrat…

CVSS 5.3 · Medium

Vendor/product tagsBeta · best-effort

Showing 1-4 of 4 CVEsPage 1 of 1