harmonicinc vulnerabilities

Products

• nsg 9000 firmware 2
• nsg 9000 1
• nsg 9000-6g firmware 1

Latest harmonicinc CVEs

Newest publication first

1. CVE-2023-33477 In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path.

   Published 2023-06-06

   Medium·CVSS 6.5 EPSS 0.99%

   In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path.

2. CVE-2018-14943 Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account.

   Published 2018-08-05

   Critical·CVSS 9.8 EPSS 1.5%

   Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account.

3. CVE-2018-14942 Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATION_GET_FILE" or "POST /PY/EMULATION_EXPORT" with FileName=../../....

   Published 2018-08-05

   High·CVSS 8.8 EPSS 2.0%

   Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATION_GET_FILE" or "POST /PY/EMULATION_EXPORT" with FileName=../../../passwd in the POST data.

4. CVE-2018-14941 Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for the /webapp.py URI.

   Published 2018-08-05

   Medium·CVSS 6.5 EPSS 1.0%

   Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for the /webapp.py URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.