Sign-up

VARIoT news about IoT security

CVE-2025-24322: Unsafe Default Authentication Vulnerability in Tenda AC6 - Cybersecurity Exploit Tracker by Ameeba

Related entries in the VARIoT vulnerabilities database: VAR-202508-2012

Trust: 4.75

Fetched: Sept. 9, 2025, 9:28 a.m., Published: Sept. 6, 2025, 8:04 p.m.
 Vulnerabilities: authentication vulnerability, code execution
Affected productsExternal IDs
db: NVD ids: CVE-2025-24322

Update now! Apple issues iOS, iPadOS, and macOS updates to fix a critical flaw | Macworld

Trust: 4.0

Fetched: Sept. 9, 2025, 9:23 a.m., Published: Aug. 20, 2025, midnight
 Vulnerabilities: memory corruption
Affected productsExternal IDs
vendor: apple model: macos
vendor: apple model: software update

FreePBX Servers Targeted by Zero-Day Flaw, Emergency Patch Now Available

Trust: 5.75

Fetched: Sept. 9, 2025, 9:23 a.m., Published: Aug. 29, 2025, 9:44 a.m.
 Vulnerabilities: authentication bypass, code execution
Affected productsExternal IDs
vendor: sangoma model: asterisk
db: NVD ids: CVE-2025-57819

CVE-2025-39690 | Armis Vulnerability Intelligence Database

Trust: 3.0

Fetched: Sept. 9, 2025, 9:21 a.m., Published: Sept. 5, 2025, 6:15 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-39690

CISA Alerts On Critical SunPower Vulnerability Allowing Full Device Takeover - Cybernoz - Cybersecurity News

Trust: 3.0

Fetched: Sept. 9, 2025, 9:21 a.m., Published: Sept. 3, 2025, 10:18 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-9696

UAE Cyber Security Council warns of smart home device vulnerabilities | News Minimalist

Trust: 3.25

Fetched: Sept. 9, 2025, 9:20 a.m., Published: Sept. 7, 2025, 11:01 a.m.
 Vulnerabilities: -
Affected productsExternal IDs

SinoTrack GPS Devices Exposed: Default Passwords Allow Remote Vehicle Control June 11, 2025 IoT Security / Vulnerability Recent security vulnerabilities in SinoTrack GPS devices could enable unauthorized remote control of specific functions in connected vehicles, including location tracking. According to an advisory from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), "Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface." This access may enable attackers to execute functions such as tracking vehicle location and, where applicable, disconnecting the fuel pump. The vulnerabilities impact all versions of the SinoTrack IoT PC Platform. Below is a brief overview of the identified flaws: CVE-2025-5484 (CVSS score: 8.3) - Weak authentication in the central SinoTrack device management interface due to the reliance on a default password and a username that serves as an identifier. - Breach Spot

Trust: 4.0

Fetched: Sept. 9, 2025, 9:20 a.m., Published: Aug. 21, 2025, 6:45 p.m.
 Vulnerabilities: default password
Affected productsExternal IDs
db: NVD ids: CVE-2025-5484

CVE-2025-39721 | Armis Vulnerability Intelligence Database

Trust: 5.25

Fetched: Sept. 9, 2025, 9:19 a.m., Published: Sept. 5, 2025, 6:15 p.m.
 Vulnerabilities: kernel crash
Affected productsExternal IDs
db: NVD ids: CVE-2025-39721

FirmVulLinker: Leveraging Multi-Dimensional Firmware Profiling for Identifying Homologous Vulnerabilities in Internet of Things Devices

Trust: 3.25

Fetched: Sept. 9, 2025, 9:15 a.m., Published: Jan. 9, 2025, midnight
 Vulnerabilities: memory corruption, information leakage, command execution...
Affected productsExternal IDs
vendor: axis model: axis
vendor: canonical model: ubuntu

CISA Warns of Android 0-Day Use-After-Free Vulnerability Exploited in

Trust: 5.0

Fetched: Sept. 9, 2025, 9:14 a.m., Published: Sept. 8, 2025, midnight
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: google model: android
db: NVD ids: CVE-2025-48543

Microsoft Patch Tuesday August 2025 Released - 107 Vulnerabilities Fixed, Including 35 RCE

Trust: 3.75

Fetched: Sept. 9, 2025, 9:13 a.m., Published: Aug. 12, 2025, 5:32 p.m.
 Vulnerabilities: denial of service, information disclosure, cross-site scripting...
Affected productsExternal IDs
db: NVD ids: CVE-2025-53136, CVE-2025-53732, CVE-2025-49736, CVE-2025-53786, CVE-2025-53769, CVE-2025-49755, CVE-2025-50161, CVE-2025-50156, CVE-2025-53734, CVE-2025-50160, CVE-2025-53138, CVE-2025-53772, CVE-2025-50158, CVE-2025-49745, CVE-2025-53723, CVE-2025-49759, CVE-2025-53728, CVE-2025-53737, CVE-2025-49761, CVE-2025-53766, CVE-2025-25005, CVE-2025-50176, CVE-2025-53722, CVE-2025-53155, CVE-2025-53153, CVE-2025-53778, CVE-2025-25007, CVE-2025-33051, CVE-2025-50157, CVE-2025-53133, CVE-2025-53735, CVE-2025-50163, CVE-2025-53151, CVE-2025-53144, CVE-2025-53142, CVE-2025-53140, CVE-2025-50162, CVE-2025-53733, CVE-2025-50171, CVE-2025-49758, CVE-2025-53738, CVE-2025-53716, CVE-2025-53783, CVE-2025-53721, CVE-2025-49751, CVE-2025-53724, CVE-2025-50154, CVE-2025-50153, CVE-2025-50170, CVE-2025-25006, CVE-2025-53781, CVE-2025-49743, CVE-2025-53741, CVE-2025-53759, CVE-2025-50159, CVE-2025-53145, CVE-2025-53789, CVE-2025-49707, CVE-2025-53719, CVE-2025-53131, CVE-2025-53739, CVE-2025-50166, CVE-2025-53148, CVE-2025-53141, CVE-2025-50155, CVE-2025-50168, CVE-2025-50177, CVE-2025-53143, CVE-2025-53726, CVE-2025-53137, CVE-2025-48807, CVE-2025-49757, CVE-2025-53736, CVE-2025-50164, CVE-2025-53761, CVE-2025-24999, CVE-2025-50169, CVE-2025-53727, CVE-2025-53793, CVE-2025-47954, CVE-2025-53152, CVE-2025-53779, CVE-2025-53731, CVE-2025-53132, CVE-2025-53765, CVE-2025-53788, CVE-2025-53740, CVE-2025-53135, CVE-2025-53147, CVE-2025-53156, CVE-2025-50172, CVE-2025-53729, CVE-2025-53784, CVE-2025-53725, CVE-2025-53134, CVE-2025-53773, CVE-2025-53149, CVE-2025-50167, CVE-2025-53730, CVE-2025-50165, CVE-2025-53760, CVE-2025-53154, CVE-2025-49762, CVE-2025-53720, CVE-2025-53718, CVE-2025-49712, CVE-2025-50173

CVE-2025-10093 - D-Link DIR-852 Device Configuration getcfg.php phpcgi_main information disclosure - SecAlerts

Related entries in the VARIoT vulnerabilities database: VAR-202509-0249

Trust: 5.0

Fetched: Sept. 9, 2025, 9:12 a.m., Published: -
 Vulnerabilities: information disclosure
Affected productsExternal IDs
vendor: d-link model: dir-852
db: NVD ids: CVE-2025-10093

WhatsApp Zero-Click Vulnerability - Review | Security Curated

Trust: 4.75

Fetched: Sept. 9, 2025, 9:11 a.m., Published: Sept. 2, 2025, 3:10 a.m.
 Vulnerabilities: memory corruption
Affected productsExternal IDs
vendor: trend model: security
db: NVD ids: CVE-2025-55177, CVE-2025-43300

Apple Confirms Critical 0-Day Under Active Attack - Immediate Update Urged

Trust: 4.75

Fetched: Sept. 9, 2025, 9:11 a.m., Published: Aug. 21, 2025, 6:06 a.m.
 Vulnerabilities: memory corruption
Affected productsExternal IDs
vendor: apple model: iphone
vendor: apple model: ipad air
vendor: apple model: ipad
vendor: apple model: software update
db: NVD ids: CVE-2025-43300

Honeywell OneWireless Wireless Device Manager (WDM) | CISA

Trust: 3.75

Fetched: Sept. 9, 2025, 9:10 a.m., Published: Sept. 1, 2025, midnight
 Vulnerabilities: buffer overread, denial of service, information exposure...
Affected productsExternal IDs
db: NVD ids: CVE-2025-2522, CVE-2025-2521, CVE-2025-3946, CVE-2025-2523

Android's September Security Nightmare: Critical Vulnerabilities Leave Millions Exposed | Technobezz

Trust: 5.75

Fetched: Sept. 9, 2025, 9:10 a.m., Published: Sept. 6, 2025, 7:36 p.m.
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: google model: pixel
vendor: google model: android
vendor: google model: wifi
db: NVD ids: CVE-2025-38352, CVE-2025-48539

Apple rushes out fix for active zero-day in iOS and macOS • The Register

Trust: 4.75

Fetched: Sept. 9, 2025, 9:08 a.m., Published: -
 Vulnerabilities: memory corruption
Affected productsExternal IDs
vendor: apple model: icloud
vendor: apple model: macos
db: NVD ids: CVE-2025-43300

CISA Warns of Critical SunPower Device Vulnerability Let Attackers Gain Full Device Access

Trust: 3.0

Fetched: Sept. 9, 2025, 9:08 a.m., Published: Sept. 3, 2025, 7:43 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-9696

Security Vulnerability Exposes Medtronic MyCareLink Patient Monitors to Attacks

Trust: 4.75

Fetched: Sept. 9, 2025, 9:07 a.m., Published: Sept. 2, 2025, midnight
 Vulnerabilities: -
Affected productsExternal IDs
vendor: medtronic model: mycarelink patient monitor
db: NVD ids: CVE-2025-4395

Reset your Android device to factory settings - Android Help

Trust: 3.0

Fetched: Sept. 9, 2025, 9:06 a.m., Published: Sept. 9, 2025, midnight
 Vulnerabilities: -
Affected productsExternal IDs
vendor: google model: android