mercusys - MidnightBSD Security Advisories

CVE-2021-23241 MEDIUM

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-22,

Products Affected

Vendor	Product	Version
mercusys	mercury_x18g_firmware	1.0.5

CVE-2021-23242 MEDIUM

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-22,

Products Affected

Vendor	Product	Version
mercusys	mercury_x18g_firmware	1.0.5

CVE-2021-25810 MEDIUM

Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
mercusys	mercury_x18g_firmware	1.0.5

CVE-2021-25811 HIGH

MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is exploted the device will not be able to access the webserver unless the listen_http_lan parameter to uhttpd.json is manually fixed.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6

CVSS 2.0

Severity: HIGH

Problem Type: NVD-CWE-noinfo,

Products Affected

Vendor	Product	Version
mercusys	mercury_x18g_firmware	1.0.5

CVE-2022-26987 HIGH

TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MmtAtePrase` function. Local users could get remote code execution.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-787,

Products Affected

Vendor	Product	Version
fastcom	fac1900r_firmware	20190827_2.0.2
tp-link	tl-wdr7620_firmware	-
mercusys	mercury_d196g_firmware	20200109_2.0.4
tp-link	tl-wdr7660_firmware	2.0.30
tp-link	tl-wdr7661_firmware	-
tp-link	tl-wdr5660_firmware	-

CVE-2022-26988 HIGH

TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MntAte` function. Local users could get remote code execution.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-787,

Products Affected

Vendor	Product	Version
fastcom	fac1900r_firmware	20190827_2.0.2
tp-link	tl-wdr7620_firmware	-
mercusys	mercury_d196g_firmware	20200109_2.0.4
tp-link	tl-wdr7660_firmware	2.0.30
tp-link	tl-wdr7661_firmware	-
tp-link	tl-wdr5660_firmware	-

CVE-2025-56463

Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.8	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	0.9	5.9

Products Affected

Vendor	Product	Version
mercusys	mw305r_firmware	*

Advisories for mercusys