← Back

Dasanzhone

dasanzhone

4 CVEs • 4 products

Products (4)

Click to collapse
Toggle
Znid 2426a Firmware
znid_2426a_firmware
3 CVEs
Znid Gpon 2426a Eu Firmware
znid_gpon_2426a_eu_firmware
1 CVE
Znid 2426a
znid_2426a
0 CVEs
Znid Gpon 2426a Eu
znid_gpon_2426a_eu
0 CVEs

CVEs (4)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-8356
1Dasanzhone
1Znid 2426a Firmware
Nov 21, 2024
Nov 21, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference.
CVE-2019-10677
1Dasanzhone
1Znid Gpon 2426a Eu Firmware
Jun 17, 2026
Sep 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET pa...Show more
Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reg).Show less
CVE-2014-9118
1Dasanzhone
1Znid 2426a Firmware
May 13, 2026
Oct 17, 2017
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.
CVE-2014-8357
1Dasanzhone
1Znid 2426a Firmware
May 13, 2026
Oct 17, 2017
N/A· v4
8.8 HIGH· v3
4.0 MEDIUM· v2
backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to obtain arbitrary user passwords via the sessionKey parameter i...Show more
backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf.Show less