Deviceways

Router

Hongdian H8922

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

Hardwarev30

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.

Release listed · 25.12.6

Get OpenWrt firmwarefirmware-selector.openwrt.org
Original project github.com
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

Device details — v30 — Source documentation (openwrt.org)

Hardware revision
v30

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

Hongdian H8922

Hongdian H8922 3.0.5 devices allow Directory Traversal

CVE-2021-28149

Affected firmware
H8922: 3.0.5
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file.

CVE published

Hongdian H8922

Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via /backup2.cgi.

CVE-2021-28150

Affected firmware
H8922: 3.0.5
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via /backup2.cgi.

CVE published

Hongdian H8922

Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser

CVE-2021-28152

Affected firmware
H8922: 3.0.5
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is used on port 5188 with the default credentials of root:superzxmn.

CVE published

Hongdian H8922

Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the…

CVE-2021-28151

Affected firmware
H8922: 3.0.5
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the username guest and password guest.

Check more security advisories for this device · CVE.org