CVE-2013-3367

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_24Mhw3.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.ise.io/casestudies/exploiting-soho-routers/Not Applicable, Third Party Advisory
https://www.ise.io/soho_service_hacks/Not Applicable, Third Party Advisory
https://www.ise.io/wp-content/uploads/2017/07/soho_techreport.pdfThird Party Advisory
https://www.ise.io/casestudies/exploiting-soho-routers/Not Applicable, Third Party Advisory
https://www.ise.io/soho_service_hacks/Not Applicable, Third Party Advisory
https://www.ise.io/wp-content/uploads/2017/07/soho_techreport.pdfThird Party Advisory

Timeline

Published: Nov 13, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-33683.3bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink att CVE-2013-33696.0Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administ CVE-2013-33706.8Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which all CVE-2013-33714.3Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inj CVE-2013-33724.3Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers CVE-2013-33735.0CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary CVE-2013-33744.3Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session CVE-2013-33754.3Cross-site scripting (XSS) vulnerability in the portal page in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers CVE-2013-33764.3Open redirect vulnerability in the help page in Cisco Video Surveillance Operations Manager allows remote attackers to redirect users to arb CVE-2013-33777.8Cisco TelePresence TC Software before 5.1.7 and TE Software before 4.1.3 allow remote attackers to cause a denial of service (device reload)CVE-2013-33787.8Cisco TelePresence TC Software before 6.1 and TE Software before 4.1.3 allow remote attackers to cause a denial of service (temporary device CVE-2013-33798.3The firewall subsystem in Cisco TelePresence TC Software before 4.2 does not properly implement rules that grant access to hosts, which allo