GCVE - cpe:2.3:o:hongdian:h8922_firmware:3.0.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:hongdian:h8922_firmware:3.0.5:*:*:*:*:*:*:*

part: o version: 3.0.5 update: *

Vendor	Hongdian (`2b8e93d1-d9c3-5f4a-b9ce-7f44811f6d5b`)
Product	H8922 Firmware (`4730c643-3d3d-5c2a-a7f7-3bfe9a292eae`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-28152`	vulnerable	2026-06-08 05:31:23.018086	Details available Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is used on port 5188 with the default credentials of root:superzxmn. Published: 2021-05-06T15:11:59.000Z Updated: 2024-08-03T21:40:12.055Z Open on db.gcve.eu Reference links http://en.hongdian.com/Products/Details/H8922 https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-28151`	vulnerable	2026-06-08 05:31:23.017568	Details available Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the username guest and password guest. Published: 2021-05-06T15:11:50.000Z Updated: 2024-08-03T21:40:12.163Z Open on db.gcve.eu Reference links http://en.hongdian.com/Products/Details/H8922 https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-28150`	vulnerable	2026-06-08 05:31:23.017116	Details available Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via /backup2.cgi. Published: 2021-05-06T15:12:09.000Z Updated: 2024-08-03T21:40:12.097Z Open on db.gcve.eu Reference links http://en.hongdian.com/Products/Details/H8922 https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-28149`	vulnerable	2026-06-08 05:31:23.015646	Details available Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file. Published: 2021-05-06T15:12:30.000Z Updated: 2024-08-03T21:40:12.057Z Open on db.gcve.eu Reference links http://en.hongdian.com/Products/Details/H8922 https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.