MilesightVPN vulnerabilities
4 known vulnerabilities in MilesightVPN from MileSight. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
MilesightVPN: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability.
- 9.8 Critical severity
MilesightVPN: Use of Hard-coded Cryptographic Key
An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerabili
- 8.1 High severity
MilesightVPN: Improper Neutralization of Special Elements used in an OS Command
An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to command execution. An attacker can send a malicious packet to trigger this vulnerability.
- 9.8 Critical severity
MilesightVPN: Improper Neutralization of Special Elements used in an SQL Command
A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a malicious packet to trigger this vulnerability.