Sign-up

VARIoT news about IoT security

The NRF52810 Hack: How A Single Chip Vulnerability Exposes Billions Of IoT Devices - Undercode Testing

Trust: 3.75

Fetched: Sept. 9, 2025, 9:33 a.m., Published: Sept. 6, 2025, 8:06 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-9709

25,000 IPs Scanned Cisco ASA Devices - New Vulnerability Potentially Incoming

Related entries in the VARIoT vulnerabilities database: VAR-202007-1057

Trust: 3.5

Fetched: Sept. 9, 2025, 9:32 a.m., Published: Sept. 4, 2025, midnight
 Vulnerabilities: -
Affected productsExternal IDs
vendor: cisco model: asa software
vendor: cisco model: cisco ios
vendor: cisco model: adaptive security appliance
vendor: cisco model: cisco adaptive security appliance
db: NVD ids: CVE-2020-3452

⚡ Weekly Recap: WhatsApp 0-Day, Docker Bug, Salesforce Breach, Fake CAPTCHAs, Spyware App & More

Trust: 4.25

Fetched: Sept. 9, 2025, 9:31 a.m., Published: Sept. 1, 2025, 1:02 p.m.
 Vulnerabilities: command execution, code execution
Affected productsExternal IDs
vendor: apple model: installer
vendor: apple model: macos
vendor: zoom model: client
vendor: cisco model: series switches
vendor: cisco model: series
vendor: cisco model: meeting
vendor: cisco model: cisco integrated management controller
vendor: cisco model: integrated management controller
vendor: cisco model: nexus
vendor: cisco model: guard
vendor: cisco model: nexus 3000
vendor: cisco model: cisco unified computing system
vendor: cisco model: unified computing system
vendor: cisco model: unified computing system manager
vendor: sonicwall model: ssl vpn
vendor: sonicwall model: remote access
vendor: sonicwall model: switch
vendor: hikvision model: hikvision
vendor: litespeed model: litespeed web server
vendor: tableau model: tableau server
vendor: tableau model: server
vendor: lite model: litespeed web server
vendor: google model: nexus
vendor: google model: chrome
vendor: google model: google chrome
db: NVD ids: CVE-2025-34511, CVE-2025-9478, CVE-2025-39247, CVE-2025-20241, CVE-2025-20295, CVE-2025-26496, CVE-2025-34510, CVE-2025-8067, CVE-2025-39246, CVE-2025-50975, CVE-2025-52520, CVE-2025-53118, CVE-2025-39245, CVE-2025-34158, CVE-2025-23307, CVE-2025-54370, CVE-2025-20317, CVE-2025-53506, CVE-2025-49146, CVE-2025-9074, CVE-2025-43300, CVE-2025-54939, CVE-2025-48976, CVE-2025-34509, CVE-2025-20294, CVE-2025-50979, CVE-2025-55177, CVE-2025-9118, CVE-2025-57819

Siemens COMOS | CISA

Trust: 4.75

Fetched: Sept. 9, 2025, 9:30 a.m., Published: Jan. 10, 2023, midnight
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: siemens model: comos
db: NVD ids: CVE-2024-8894

GovCERT.HK - High Threat Security Alert (A25-08-18): Vulnerability in Apple Products

Trust: 4.75

Fetched: Sept. 9, 2025, 9:30 a.m., Published: Aug. 25, 2018, midnight
 Vulnerabilities: denial of service, code execution
Affected productsExternal IDs
vendor: apple model: macos
vendor: apple model: ipad
vendor: apple model: iphone
db: NVD ids: CVE-2025-43300

Salt Typhoon Exploits Flaws in Edge Network Devices to Breach 600 Organizations Worldwide

Related entries in the VARIoT vulnerabilities database: VAR-201803-1387

Trust: 3.75

Fetched: Sept. 9, 2025, 9:29 a.m., Published: Aug. 28, 2025, 2:04 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: cisco model: routers
vendor: cisco model: cisco ios
vendor: cisco model: ios xr
vendor: cisco model: cisco ios xr
vendor: palo alto networks model: networks
vendor: palo model: networks
db: NVD ids: CVE-2023-20273, CVE-2024-3400, CVE-2024-21887, CVE-2018-0171, CVE-2023-20198, CVE-2023-46805

Configure a Vulnerability Protection Profile (PAN-OS & Panorama)

Trust: 3.25

Fetched: Sept. 9, 2025, 9:29 a.m., Published: Sept. 2, 2025, 3:14 p.m.
 Vulnerabilities: command injection, sql injection
Affected productsExternal IDs
vendor: palo alto networks model: networks
vendor: palo alto networks model: firewall
vendor: palo alto networks model: pan-os
vendor: palo model: networks
vendor: palo model: firewall
vendor: palo model: pan-os

CVE-2025-24322: Unsafe Default Authentication Vulnerability in Tenda AC6 - Cybersecurity Exploit Tracker by Ameeba

Related entries in the VARIoT vulnerabilities database: VAR-202508-2012

Trust: 4.75

Fetched: Sept. 9, 2025, 9:28 a.m., Published: Sept. 6, 2025, 8:04 p.m.
 Vulnerabilities: authentication vulnerability, code execution
Affected productsExternal IDs
db: NVD ids: CVE-2025-24322

Update now! Apple issues iOS, iPadOS, and macOS updates to fix a critical flaw | Macworld

Trust: 4.0

Fetched: Sept. 9, 2025, 9:23 a.m., Published: Aug. 20, 2025, midnight
 Vulnerabilities: memory corruption
Affected productsExternal IDs
vendor: apple model: macos
vendor: apple model: software update

FreePBX Servers Targeted by Zero-Day Flaw, Emergency Patch Now Available

Trust: 5.75

Fetched: Sept. 9, 2025, 9:23 a.m., Published: Aug. 29, 2025, 9:44 a.m.
 Vulnerabilities: authentication bypass, code execution
Affected productsExternal IDs
vendor: sangoma model: asterisk
db: NVD ids: CVE-2025-57819

CVE-2025-39690 | Armis Vulnerability Intelligence Database

Trust: 3.0

Fetched: Sept. 9, 2025, 9:21 a.m., Published: Sept. 5, 2025, 6:15 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-39690

CISA Alerts On Critical SunPower Vulnerability Allowing Full Device Takeover - Cybernoz - Cybersecurity News

Trust: 3.0

Fetched: Sept. 9, 2025, 9:21 a.m., Published: Sept. 3, 2025, 10:18 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-9696

UAE Cyber Security Council warns of smart home device vulnerabilities | News Minimalist

Trust: 3.25

Fetched: Sept. 9, 2025, 9:20 a.m., Published: Sept. 7, 2025, 11:01 a.m.
 Vulnerabilities: -
Affected productsExternal IDs

SinoTrack GPS Devices Exposed: Default Passwords Allow Remote Vehicle Control June 11, 2025 IoT Security / Vulnerability Recent security vulnerabilities in SinoTrack GPS devices could enable unauthorized remote control of specific functions in connected vehicles, including location tracking. According to an advisory from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), "Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface." This access may enable attackers to execute functions such as tracking vehicle location and, where applicable, disconnecting the fuel pump. The vulnerabilities impact all versions of the SinoTrack IoT PC Platform. Below is a brief overview of the identified flaws: CVE-2025-5484 (CVSS score: 8.3) - Weak authentication in the central SinoTrack device management interface due to the reliance on a default password and a username that serves as an identifier. - Breach Spot

Trust: 4.0

Fetched: Sept. 9, 2025, 9:20 a.m., Published: Aug. 21, 2025, 6:45 p.m.
 Vulnerabilities: default password
Affected productsExternal IDs
db: NVD ids: CVE-2025-5484

CVE-2025-39721 | Armis Vulnerability Intelligence Database

Trust: 5.25

Fetched: Sept. 9, 2025, 9:19 a.m., Published: Sept. 5, 2025, 6:15 p.m.
 Vulnerabilities: kernel crash
Affected productsExternal IDs
db: NVD ids: CVE-2025-39721

FirmVulLinker: Leveraging Multi-Dimensional Firmware Profiling for Identifying Homologous Vulnerabilities in Internet of Things Devices

Trust: 3.25

Fetched: Sept. 9, 2025, 9:15 a.m., Published: Jan. 9, 2025, midnight
 Vulnerabilities: memory corruption, information leakage, command execution...
Affected productsExternal IDs
vendor: axis model: axis
vendor: canonical model: ubuntu

CISA Warns of Android 0-Day Use-After-Free Vulnerability Exploited in

Trust: 5.0

Fetched: Sept. 9, 2025, 9:14 a.m., Published: Sept. 8, 2025, midnight
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: google model: android
db: NVD ids: CVE-2025-48543

Microsoft Patch Tuesday August 2025 Released - 107 Vulnerabilities Fixed, Including 35 RCE

Trust: 3.75

Fetched: Sept. 9, 2025, 9:13 a.m., Published: Aug. 12, 2025, 5:32 p.m.
 Vulnerabilities: denial of service, information disclosure, cross-site scripting...
Affected productsExternal IDs
db: NVD ids: CVE-2025-53136, CVE-2025-53732, CVE-2025-49736, CVE-2025-53786, CVE-2025-53769, CVE-2025-49755, CVE-2025-50161, CVE-2025-50156, CVE-2025-53734, CVE-2025-50160, CVE-2025-53138, CVE-2025-53772, CVE-2025-50158, CVE-2025-49745, CVE-2025-53723, CVE-2025-49759, CVE-2025-53728, CVE-2025-53737, CVE-2025-49761, CVE-2025-53766, CVE-2025-25005, CVE-2025-50176, CVE-2025-53722, CVE-2025-53155, CVE-2025-53153, CVE-2025-53778, CVE-2025-25007, CVE-2025-33051, CVE-2025-50157, CVE-2025-53133, CVE-2025-53735, CVE-2025-50163, CVE-2025-53151, CVE-2025-53144, CVE-2025-53142, CVE-2025-53140, CVE-2025-50162, CVE-2025-53733, CVE-2025-50171, CVE-2025-49758, CVE-2025-53738, CVE-2025-53716, CVE-2025-53783, CVE-2025-53721, CVE-2025-49751, CVE-2025-53724, CVE-2025-50154, CVE-2025-50153, CVE-2025-50170, CVE-2025-25006, CVE-2025-53781, CVE-2025-49743, CVE-2025-53741, CVE-2025-53759, CVE-2025-50159, CVE-2025-53145, CVE-2025-53789, CVE-2025-49707, CVE-2025-53719, CVE-2025-53131, CVE-2025-53739, CVE-2025-50166, CVE-2025-53148, CVE-2025-53141, CVE-2025-50155, CVE-2025-50168, CVE-2025-50177, CVE-2025-53143, CVE-2025-53726, CVE-2025-53137, CVE-2025-48807, CVE-2025-49757, CVE-2025-53736, CVE-2025-50164, CVE-2025-53761, CVE-2025-24999, CVE-2025-50169, CVE-2025-53727, CVE-2025-53793, CVE-2025-47954, CVE-2025-53152, CVE-2025-53779, CVE-2025-53731, CVE-2025-53132, CVE-2025-53765, CVE-2025-53788, CVE-2025-53740, CVE-2025-53135, CVE-2025-53147, CVE-2025-53156, CVE-2025-50172, CVE-2025-53729, CVE-2025-53784, CVE-2025-53725, CVE-2025-53134, CVE-2025-53773, CVE-2025-53149, CVE-2025-50167, CVE-2025-53730, CVE-2025-50165, CVE-2025-53760, CVE-2025-53154, CVE-2025-49762, CVE-2025-53720, CVE-2025-53718, CVE-2025-49712, CVE-2025-50173

CVE-2025-10093 - D-Link DIR-852 Device Configuration getcfg.php phpcgi_main information disclosure - SecAlerts

Related entries in the VARIoT vulnerabilities database: VAR-202509-0249

Trust: 5.0

Fetched: Sept. 9, 2025, 9:12 a.m., Published: -
 Vulnerabilities: information disclosure
Affected productsExternal IDs
vendor: d-link model: dir-852
db: NVD ids: CVE-2025-10093

WhatsApp Zero-Click Vulnerability - Review | Security Curated

Trust: 4.75

Fetched: Sept. 9, 2025, 9:11 a.m., Published: Sept. 2, 2025, 3:10 a.m.
 Vulnerabilities: memory corruption
Affected productsExternal IDs
vendor: trend model: security
db: NVD ids: CVE-2025-55177, CVE-2025-43300