Generex Ups Cs141 vulnerabilities

CVE-2022-47190 [CRITICAL] CWE-20 CVE-2022-47190: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file contai Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root.

CVE-2022-47192 [HIGH] CWE-20 CVE-2022-47192: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containi Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password.

CVE-2022-47186 [CRITICAL] CWE-434 CVE-2022-47186: There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attack There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory.

CVE-2022-47191 [HIGH] CWE-20 CVE-2022-47191: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file contai Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.

CVE-2022-47189 [CRITICAL] CWE-20 CVE-2022-47189: Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an inco Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device.

CVE-2022-47188 [HIGH] CWE-20 CVE-2022-47188: There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacke There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path.

CVE-2022-47187 [MEDIUM] CWE-79 CVE-2022-47187: There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application al There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file.