generex 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
公開された問題は vendor risk input validation、パス処理の欠陥, and vendor risk cross-site scripting に関連することが多く、vendor surface production workloads and vendor surface software deployment の文脈で ファイル上書き and vendor impact session compromise などの暴露リスクを伴う場合があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2022-47187 | There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file. | [email protected] | 5.3 | 0.09% | 2023-09-28 | 2024-11-21 |
| CVE-2022-47186 | There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory. | [email protected] | 7.5 | 0.09% | 2023-09-28 | 2024-11-21 |
| CVE-2022-47192 | Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password. | [email protected] | 8.8 | 1.08% | 2023-03-31 | 2024-11-21 |
| CVE-2022-47191 | Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges. | [email protected] | 4.3 | 0.33% | 2023-03-31 | 2024-11-21 |
| CVE-2022-47190 | Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root. | [email protected] | 10.0 | 2.95% | 2023-03-31 | 2024-11-21 |
| CVE-2022-47189 | Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device. | [email protected] | 7.5 | 0.37% | 2023-03-31 | 2024-11-21 |
| CVE-2022-47188 | There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path. | [email protected] | 7.5 | 0.51% | 2023-03-31 | 2024-11-21 |
| CVE-2022-42457 | Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve-update.sh (e.g., command execution can occur via a reverse shell installed by install.sh). | [email protected] | 9.1 | 6.45% | 2022-10-06 | 2024-11-21 |
| CVE-2022-26041 | Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read or alter an arbitrary file on the server via unspecified vectors. | [email protected] | 6.5 | 0.33% | 2022-06-13 | 2024-11-21 |
| CVE-2020-11420 | UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerability by manipulating variables that reference files and by doing this achieve access to files and directories outside the web root folder. An attacker may access arbitrary files and directories stored in the file system, but integrity of the files are not jeopardized as attacker have read access rights only. | [email protected] | 6.5 | 0.59% | 2020-04-27 | 2024-11-21 |