Sign-up

VARIoT news about IoT security

Serious Security Vulnerabilities in Dahua Cameras Enable Remote Takeover via ONVIF and File Upload Exploits July 30, 2025 Firmware Security / Vulnerability Cybersecurity researchers have revealed critical security vulnerabilities within the firmware of Dahua smart cameras, which have since been patched. If left unaddressed, these flaws could allow attackers to take control of affected devices. According to a report from Bitdefender shared with The Hacker News, the vulnerabilities-related to the device's ONVIF protocol and file upload handlers-enable unauthorized attackers to execute arbitrary commands remotely, effectively seizing control of the device. Tracked as CVE-2025-31700 and CVE-2025-31701 (CVSS scores: 8.1), the vulnerabilities impact the following device series running firmware versions with build timestamps prior to April 16, 2025: IPC-1XXX Series IPC-2XXX Series IPC-WX Series IPC-ECXX Series SD3A Series SD2A Series SD3D Series SDT2A Series SD2C Series Users can check their device's build time by logging into the web interface and navigating to Settings → System Information → Version. Both vulnerabilities are classified as... - Breach Spot

Trust: 4.75

Fetched: Aug. 24, 2025, 9:51 a.m., Published: Aug. 1, 2025, 5 p.m.
 Vulnerabilities: privilege escalation
Affected productsExternal IDs
vendor: dahua model: dahua camera
vendor: dahua model: camera
db: NVD ids: CVE-2025-31701, CVE-2025-31700

CVE-2025-20133: Remote Access SSL VPN Vulnerability in Cisco Secure Firewall ASA Software and Secure FTD Software - Cybersecurity Exploit Tracker by Ameeba

Trust: 5.0

Fetched: Aug. 24, 2025, 9:50 a.m., Published: Nov. 30, 0001, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: cisco model: asa software
db: NVD ids: CVE-2025-20133

Apple fixes zero-day vulnerability exploited in "extremely sophisticated attack" (CVE-2025-43300) - Help Net Security

Trust: 6.0

Fetched: Aug. 24, 2025, 9:48 a.m., Published: Aug. 20, 2025, 7:23 p.m.
 Vulnerabilities: memory corruption
Affected productsExternal IDs
vendor: apple model: macos
db: NVD ids: CVE-2025-43300

Apple Addresses Zero-Day Vulnerability Threatening Crypto Wallets | MEXC News

Trust: 4.0

Fetched: Aug. 24, 2025, 9:47 a.m., Published: Aug. 23, 2025, 3:02 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: apple model: macos
db: NVD ids: CVE-2025-43300

Apple Releases Patch for Likely Exploited Zero-Day Vulnerability - Infosecurity Magazine

Trust: 4.75

Fetched: Aug. 24, 2025, 9:46 a.m., Published: Aug. 22, 2025, 10:30 a.m.
 Vulnerabilities: memory corruption
Affected productsExternal IDs
vendor: apple model: macos
vendor: apple model: webkit
db: NVD ids: CVE-2025-43300

Apple Patches Zero-Click Vulnerability That Posed Risks For Crypto Users - FinanceFeeds

Trust: 3.0

Fetched: Aug. 24, 2025, 9:46 a.m., Published: Aug. 22, 2025, 6:59 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: apple model: macos

Update Canonical Ubuntu Desktop: USN-7708-1: poppler vulnerability

Trust: 4.25

Fetched: Aug. 24, 2025, 9:46 a.m., Published: Jan. 24, 7708, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: canonical model: ubuntu

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Sensitive Information Disclosure Vulnerability

Trust: 5.0

Fetched: Aug. 24, 2025, 9:45 a.m., Published: Aug. 20, 2025, 3:53 p.m.
 Vulnerabilities: information disclosure
Affected productsExternal IDs
vendor: cisco model: cisco evolved programmable network manager
vendor: cisco model: cisco prime infrastructure
vendor: cisco model: prime infrastructure
vendor: cisco model: evolved programmable network manager

Latest apple news today: Is Apple failing to protect users? Zero-Click vulnerability puts iPhones, iPads, Macs and Crypto wallets at risk - The Economic Times

Trust: 3.25

Fetched: Aug. 24, 2025, 9:44 a.m., Published: Aug. 19, 2025, midnight
 Vulnerabilities: memory corruption, code execution
Affected productsExternal IDs
vendor: apple model: ipad
vendor: apple model: macos
vendor: apple model: iphone
vendor: apple model: software update

Critical HashiCorp Vulnerability Execute Arbitrary Code on Underlying Host

Trust: 3.5

Fetched: Aug. 24, 2025, 9:43 a.m., Published: Aug. 4, 2025, 10 a.m.
 Vulnerabilities: file execution, privilege escalation, code execution
Affected productsExternal IDs
db: NVD ids: CVE-2025-6000

Patch or Disable: Containing Static Tundra Exploiting CVE-2018-0171 in Cisco Devices | Windows Forum

Related entries in the VARIoT vulnerabilities database: VAR-201803-1387

Trust: 4.25

Fetched: Aug. 24, 2025, 9:42 a.m., Published: Aug. 22, 2025, 8:42 a.m.
 Vulnerabilities: buffer overflow, code execution
Affected productsExternal IDs
vendor: cisco model: tftp server
vendor: cisco model: routers
vendor: cisco model: ios xe
vendor: cisco model: cisco ios
db: NVD ids: CVE-2018-0171

Apple Addresses Zero-Day Vulnerability Threatening Crypto Wallets

Trust: 4.0

Fetched: Aug. 24, 2025, 9:42 a.m., Published: Aug. 23, 2025, 7:02 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: apple model: macos
db: NVD ids: CVE-2025-43300

Apple patches zero-click exploit threatening crypto users - TradingView News India

Trust: 3.0

Fetched: Aug. 24, 2025, 9:41 a.m., Published: Aug. 27, 2025, midnight
 Vulnerabilities: -
Affected productsExternal IDs
vendor: apple model: macos

Update Your Apple Devices ASAP to Patch This Major Security Flaw | Lifehacker

Trust: 4.0

Fetched: Aug. 24, 2025, 9:41 a.m., Published: Aug. 21, 2025, 6 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: apple model: ipad
vendor: apple model: macos
vendor: apple model: ipad air
vendor: apple model: iphone
vendor: apple model: software update
db: NVD ids: CVE-2025-43300

Apple Patches Zero-Click Exploit Threatening Crypto Users

Trust: 3.0

Fetched: Aug. 24, 2025, 9:41 a.m., Published: -
 Vulnerabilities: -
Affected productsExternal IDs
vendor: apple model: macos

Apple Zero-Day CVE-2025-43300 Exploited

Related entries in the VARIoT vulnerabilities database: VAR-202501-3666

Trust: 4.25

Fetched: Aug. 24, 2025, 9:40 a.m., Published: Aug. 24, 2025, 8 a.m.
 Vulnerabilities: privilege escalation, memory corruption, code execution
Affected productsExternal IDs
vendor: trend model: security
vendor: apple model: ipad
vendor: apple model: macos
vendor: apple model: iphone
db: NVD ids: CVE-2025-24201, CVE-2025-43300, CVE-2025-43200, CVE-2025-31201, CVE-2025-24200, CVE-2025-24085, CVE-2025-31200

10 common cybersecurity threats and attacks: 2025 update | ConnectWise

Trust: 4.5

Fetched: Aug. 22, 2025, 9:46 a.m., Published: Aug. 10, 2025, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: trend model: security
vendor: essential model: phone

Google fixed two Qualcomm bugs that were actively exploited in the wild

Trust: 5.75

Fetched: Aug. 22, 2025, 9:44 a.m., Published: Aug. 6, 2025, 6:03 a.m.
 Vulnerabilities: memory corruption, authorization issue, code execution...
Affected productsExternal IDs
vendor: google model: android
vendor: google model: chrome
db: NVD ids: CVE-2025-27038, CVE-2025-21479, CVE-2025-21480, CVE-2025-48530

Multiple Vulnerabilities in Tridium Niagara Framework

Related entries in the VARIoT vulnerabilities database: VAR-202505-2694, VAR-202505-3274, VAR-202505-3468, VAR-202505-2532, VAR-202505-2874, VAR-202505-3074, VAR-202505-3817, VAR-202505-3275, VAR-202505-3992, VAR-202505-3461

Trust: 5.5

Fetched: Aug. 22, 2025, 9:44 a.m., Published: July 25, 2025, 1:37 p.m.
 Vulnerabilities: denial of service, code execution
Affected productsExternal IDs
vendor: tridium model: niagara
vendor: tridium model: tridium niagara
vendor: tridium model: niagara framework
vendor: tridium model: framework
db: NVD ids: CVE-2025-3937, CVE-2025-3941, CVE-2025-3936, CVE-2025-3938, CVE-2025-3942, CVE-2025-3943, CVE-2025-3945, CVE-2025-3939, CVE-2025-3940, CVE-2025-3944

Critical Firmware Vulnerabilities Exposes Millions Of Dell Laptops To Device Takeover And Malware Attacks - Cybernoz - Cybersecurity News

Trust: 5.25

Fetched: Aug. 22, 2025, 9:43 a.m., Published: Aug. 6, 2025, 3:53 a.m.
 Vulnerabilities: information leakage, buffer overflow, code execution
Affected productsExternal IDs
vendor: dell model: latitude
vendor: cisco model: series
db: NVD ids: CVE-2025-24922, CVE-2025-24919, CVE-2025-24311, CVE-2025-25215, CVE-2025-25050