VARIoT IoT exploits database

Yokogawa CENTUM CS 3000 - 'BKBCopyD.exe' Remote Buffer Overflow (Metasploit). CVE-2014-0784CVE-104429 . remote exploit for Windows platform

Cisco RV110W - Password Disclosure / Command Execution. CVE-2015-6396CVE-2014-0683 . remote exploit for Hardware platform

Technicolor TC7200 - Credentials Disclosure. CVE-2014-1677CVE-103712 . webapps exploit for Hardware platform

D-LINK DIR-615 hardware version E4 with firmware version 5.10 suffers from a cross site request forgery vulnerability.

NetGear N300 DGN2200 is prone to the following security vulnerabilities: 1. A local information-disclosure vulnerability 2. Multiple cross-site request forgery vulnerabilities 3. An arbitrary file-access vulnerability 4. Multiple remote command-execution vulnerabilities 5. An unauthorized-access weakness 6. A security-bypass weakness Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive information, perform unauthorized actions in the context of a logged-in user, gain unauthorized access, or execute arbitrary commands in the context of the affected application. NetGear N300 DGN2200 running firmware 1.0.0.36-7.0.37 is vulnerable.

D-Link DSL-2750B ADSL Route' - Cross-Site Request Forgery. CVE-103350 . webapps exploit for Hardware platform

Netgear D6300B routers suffer from remote command injection, root shell spawning, UPnP issues, credentials being submitted in the clear, and additional vulnerabilities.

Netgear D6300B - '/diag.cgi?IPAddr4' Remote Command Execution. CVE-102902 . remote exploit for Hardware platform

Inteno DG301 - Command Injection. CVE-102950 . webapps exploit for Hardware platform

Inteno DG301 routers are susceptible to a remote command injection vulnerability. Proof of concept included.

SAP NetWeaver is prone to multiple security vulnerabilities, including: 1. An information-disclosure vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A denial-of-service vulnerability Attackers can exploit these issues to obtain sensitive information, perform a denial-of-service attack, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

A10 Networks AX ADC is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information. Information harvested may aid in launching further attacks. This vulnerability affects the following versions: AX ADC 2.7.0 build 217 and earlier AX ADC 2.6.1 GR1-P5 and earlier

GE Proficy CIMPLICITY - 'gefebt.exe' Remote Code Execution (Metasploit). CVE-2014-0750CVE-101193 . remote exploit for Windows platform

MuPDF 1.3 - 'xps_parse_color()' Stack Buffer Overflow. CVE-102340CVE-2014-2013 . local exploit for Windows platform

ASUS RT-N56U - Remote Buffer Overflow (ROP). CVE-2013-6343CVE-102267 . remote exploit for Hardware platform

KingScada - kxClientDownload.ocx ActiveX Remote Code Execution (Metasploit). CVE-2013-2827CVE-102135 . remote exploit for Windows platform

Conceptronic Wireless Pan & Tilt Network Camera - Cross-Site Request Forgery. CVE-2013-7204CVE-101930 . webapps exploit for Hardware platform

Multiple TP-Link Routers are prone to multiple cross-site request-forgery and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

Technicolor TC7200 - Multiple Cross-Site Scripting Vulnerabilities. CVE-2014-0620CVE-101733CVE-101732 . webapps exploit for Hardware platform

Technicolor TC7200 - Multiple Cross-Site Request Forgery Vulnerabilities. CVE-2014-0621CVE-101731CVE-101730CVE-101729CVE-101728 . webapps exploit for Hardware platform