Threats tagged 'ghsa-cc8h-f7ff-6h27'

Axel Technology WOLF1MS and WOLF2MS devices running firmware versions 0.8.5 to 1.0.3 have a critical Broken Access Control vulnerability. The flaw is due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint, allowing unauthenticated remote attackers to list user accounts, create administrative users, delete users, and modify system settings. This leads to full device compromise.