Sign-up

VARIoT news about IoT security

CVE-2025-68656 - Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability

Trust: 3.0

Fetched: Jan. 13, 2026, 9:55 a.m., Published: Jan. 12, 2026, 6:15 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-68656

Android’s January 2026 security update fixes a critical Dolby 0-click vulnerability for Pixel & Samsung devices - PiunikaWeb

Trust: 4.5

Fetched: Jan. 13, 2026, 9:55 a.m., Published: Jan. 6, 2026, 7:12 a.m.
 Vulnerabilities: integer overflow, code execution
Affected productsExternal IDs
vendor: google model: android
vendor: google model: pixel
vendor: samsung model: galaxy
vendor: samsung model: samsung galaxy
vendor: samsung model: samsung
vendor: apple model: macos
vendor: apple model: iphone
db: NVD ids: CVE-2025-54957

TOTOLINK EX200 Extender Vulnerability Allow Attacker to Gain Full System

Trust: 6.0

Fetched: Jan. 13, 2026, 9:53 a.m., Published: Jan. 7, 2026, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: wireshark model: wireshark
db: NVD ids: CVE-2025-65606

Is Your Device at Risk? Indian Government Issues Warning About Dangerous Chrome Vulnerability | WelshWave

Trust: 4.5

Fetched: Jan. 13, 2026, 9:53 a.m., Published: Dec. 23, 2025, 4:43 a.m.
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: google model: chrome
vendor: google model: google chrome
db: NVD ids: CVE-2023-4567

Cisco identifies vulnerability in ISE network access control devices | Network World

Trust: 4.0

Fetched: Jan. 13, 2026, 9:52 a.m., Published: Jan. 8, 2026, midnight
 Vulnerabilities: default credentials
Affected productsExternal IDs
vendor: cisco model: network access control

Legacy D-Link routers exploited via unauthenticated DNS hijacking

Trust: 6.25

Fetched: Jan. 13, 2026, 9:52 a.m., Published: Jan. 6, 2026, midnight
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: d-link model: router
db: NVD ids: CVE-2026-0625

CVE-2025-15017: Active Debug Code Vulnerability in Serial Device Servers | Moxa

Trust: 3.25

Fetched: Jan. 13, 2026, 9:50 a.m., Published: -
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-15017

VU#295169 - TOTOLINK EX200 firmware-upload error handling can activate an unauthenticated root telnet service

Trust: 4.0

Fetched: Jan. 13, 2026, 9:49 a.m., Published: Jan. 6, 2026, midnight
 Vulnerabilities: arbitrary command execution, command execution
Affected productsExternal IDs
db: NVD ids: CVE-2025-65606

CVE-2026-22213 - RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility

Trust: 5.5

Fetched: Jan. 13, 2026, 9:49 a.m., Published: Jan. 12, 2026, 11:15 p.m.
 Vulnerabilities: buffer overflow, memory corruption
Affected productsExternal IDs
vendor: riot model: riot
vendor: riot model: riot-os
vendor: riot-os model: riot
db: NVD ids: CVE-2026-22213

Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager

Trust: 3.75

Fetched: Jan. 13, 2026, 9:48 a.m., Published: Jan. 12, 2026, 8:12 p.m.
 Vulnerabilities: default administrator password
Affected productsExternal IDs
vendor: cisco model: cisco asyncos
vendor: cisco model: asyncos
vendor: cisco model: asyncos software

Critical 0-Day RCE Vulnerability in Networking Devices Exposes 70,000+ Hosts

Trust: 5.75

Fetched: Jan. 13, 2026, 9:48 a.m., Published: Dec. 30, 2025, 9:48 a.m.
 Vulnerabilities: command execution, code execution
Affected productsExternal IDs
db: NVD ids: CVE-2025-54322

CVE-2026-0854 Merit LILIN DH032, DVR708, DVR716 High CVETodo

Trust: 4.75

Fetched: Jan. 13, 2026, 9:47 a.m., Published: Jan. 12, 2026, 6:16 a.m.
 Vulnerabilities: command injection, command execution, code execution...
Affected productsExternal IDs
db: NVD ids: CVE-2026-0854

Cisco Identity Services Engine XML External Entity Processing Information Disclosure Vulnerability (CVE-2026-20029) - Qualys ThreatPROTECT

Trust: 6.0

Fetched: Jan. 13, 2026, 9:47 a.m., Published: -
 Vulnerabilities: information disclosure
Affected productsExternal IDs
vendor: cisco model: cisco identity services engine
vendor: cisco model: identity services engine
db: NVD ids: CVE-2026-20029

CVE-2026-22212 - TinyOS <= 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio - SecAlerts

Trust: 3.25

Fetched: Jan. 13, 2026, 9:45 a.m., Published: -
 Vulnerabilities: buffer overflow
Affected productsExternal IDs
db: NVD ids: CVE-2026-22212

TOTOLINK: Unpatched Vulnerability in TOTOLINK EX200 Puts Devices at Risk

Trust: 3.75

Fetched: Jan. 13, 2026, 9:45 a.m., Published: Jan. 7, 2026, 11:35 a.m.
 Vulnerabilities: arbitrary command execution, command execution
Affected productsExternal IDs
db: NVD ids: CVE-2025-65606

CVE-2026-22212 - TinyOS <= 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio

Trust: 5.0

Fetched: Jan. 13, 2026, 9:45 a.m., Published: Jan. 12, 2026, 11:15 p.m.
 Vulnerabilities: stack memory corruption, buffer overflow, memory corruption
Affected productsExternal IDs
db: NVD ids: CVE-2026-22212

Cisco Identity Services Engine XML External Entity Processing Information Disclosure Vulnerability

Trust: 5.0

Fetched: Jan. 13, 2026, 9:45 a.m., Published: Jan. 7, 2026, 3:54 p.m.
 Vulnerabilities: information disclosure
Affected productsExternal IDs
vendor: cisco model: cisco identity services engine
vendor: cisco model: identity services engine

React2Shell Vulnerability Exploited to Build Massive IoT Botnet - Hackers Arise

Related entries in the VARIoT vulnerabilities database: VAR-202303-1268

Trust: 4.5

Fetched: Jan. 13, 2026, 9:44 a.m., Published: Jan. 8, 2026, 1:56 p.m.
 Vulnerabilities: sql injection, code execution
Affected productsExternal IDs
vendor: hikvision model: hikvision
db: NVD ids: CVE-2025-55182, CVE-2023-1389, CVE-2025-24893, CVE-2025-66478

Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025

Trust: 5.75

Fetched: Jan. 13, 2026, 9:43 a.m., Published: Dec. 17, 2025, 10:37 p.m.
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: cisco model: finesse
vendor: cisco model: webex
vendor: cisco model: cisco finesse
vendor: cisco model: catalyst
vendor: cisco model: sd-wan
vendor: cisco model: webex meetings
vendor: cisco model: email encryption

CVE-2023-44112: Device Authentication Module Out-of-Bounds Access Vulnerability - Ameeba Exploit Tracker

Trust: 4.75

Fetched: Jan. 13, 2026, 9:42 a.m., Published: Nov. 30, 0001, midnight
 Vulnerabilities: bounds access flaw, bounds access vulnerability
Affected productsExternal IDs
db: NVD ids: CVE-2023-44112