Gryphonconnect Gryphon Tower Firmware
10 CVEs affecting Gryphonconnect Gryphon Tower Firmware. Latest disclosed: 2021-12-09. Critical: 1, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20146 | Critical | 9.8 | 2021-12-09 | An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon's development and i… |
CVE-2021-20144 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20143 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20142 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20141 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20140 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20139 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon Tower routers. An unauth… |
CVE-2021-20138 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenti… |
CVE-2021-20145 | High | 7.5 | 2021-12-09 | Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the… |
CVE-2021-20137 | Medium | 6.1 | 2021-12-09 | A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface… |