Chunghwa Telecom vulnerabilities
We track 12 vulnerabilities in Chunghwa Telecom products across 4 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on November 17, 2025.
Latest Chunghwa Telecom vulnerabilities
- 7.1 High severity
TenderDocTransfer: Absolute Path Traversal
TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, un
- 8.1 High severity
TenderDocTransfer: Absolute Path Traversal
TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenti
- 8.1 High severity
topm-client: Absolute Path Traversal
The topm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated rem
- 7.1 High severity
tbm-client: Absolute Path Traversal
The tbm-client from Chunghwa Telecom has an Arbitrary File vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote atta
- 8.1 High severity
tbm-client: Absolute Path Traversal
The tbm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remo
- 8.1 High severity
TenderDocTransfer: Relative Path Traversal
TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated r
- 9.6 Critical severity
TenderDocTransfer: Improper Neutralization of Input During Web Page Generation
TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthen
- 9.8 Critical severity
Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for…
Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting
- 8.8 High severity
NOKIA G-040W-Q: Weak Password Requirements
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing
- 7.2 High severity
NOKIA G-040W-Q: Improper Neutralization of Special Elements used in an OS Command
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system
- 9.8 Critical severity
NOKIA G-040W-Q: Missing Authentication for Critical Functionality
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remot
- 9.8 Critical severity
NOKIA G-040W-Q: Improper Restriction of Excessive Authentication Attempts
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypa