https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T10:20:35.332678+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2023-49255 CVE-2023-49255 — Router console accessible without authentication 2026-10-16T10:20:35.334241+00:00

Affected: Hongdian H8951-4G-ESP

The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one. If the logged in user has administrative privileges, it is possible to use webadmin service configuration commands to create a new admin user with a chosen password.