Sign-up

VARIoT news about IoT security

Security Researchers: 7 Vulnerabilities found in Android and Pixel devices

Trust: 6.0

Fetched: Dec. 20, 2024, 9:50 a.m., Published: Nov. 26, 2024, 7:54 a.m.
 Vulnerabilities: configuration flaw
Affected productsExternal IDs
vendor: google model: android
vendor: google model: pixel
db: NVD ids: CVE-2021-0600, CVE-2023-21292, CVE-2023-20963, CVE-2023-21383, CVE-2024-34719, CVE-2024-0017

CVE-2024-53677 - Exploitation Attempts Of Critical Apache Struts RCE Vulnerability | Ervik.as

Trust: 5.5

Fetched: Dec. 20, 2024, 9:50 a.m., Published: Dec. 19, 2024, 5:58 p.m.
 Vulnerabilities: code execution, path traversal
Affected productsExternal IDs
vendor: palo model: pan-os
vendor: palo model: networks
vendor: palo alto networks model: pan-os
vendor: palo alto networks model: networks
db: NVD ids: CVE-2024-9474, CVE-2023-50164, CVE-2024-53677, CVE-2024-0012

2000+ Palo Alto Firewalls Hacked Exploiting New Vulnerabilities

Trust: 5.5

Fetched: Dec. 20, 2024, 9:49 a.m., Published: Nov. 22, 2024, 2:11 a.m.
 Vulnerabilities: authentication bypass, privilege escalation
Affected productsExternal IDs
vendor: palo model: pan-os
vendor: palo model: networks
vendor: palo model: firewall
vendor: palo alto networks model: pan-os
vendor: palo alto networks model: networks
vendor: palo alto networks model: firewall
db: NVD ids: CVE-2024-9474, CVE-2024-0012

Critical Vulnerability Alert: Update Required for TropOS Devices | Windows Forum

Related entries in the VARIoT vulnerabilities database: VAR-201401-0184

Trust: 5.5

Fetched: Dec. 20, 2024, 9:44 a.m., Published: May 20, 2024, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: delegate model: delegate
vendor: mesh model: mesh
db: NVD ids: CVE-2013-5211

Device Detector <= 4.2.0 - Reflected Cross-Site Scripting via id

Trust: 3.0

Fetched: Dec. 20, 2024, 9:43 a.m., Published: Dec. 14, 2024, midnight
 Vulnerabilities: cross-site scripting
Affected productsExternal IDs

Sophos Firewall Vulnerabilities Let Attackers Execute Remote Code

Trust: 5.5

Fetched: Dec. 20, 2024, 9:43 a.m., Published: Dec. 20, 2024, 4:35 a.m.
 Vulnerabilities: code injection, code execution, sql injection
Affected productsExternal IDs
vendor: sophos model: firewall
db: NVD ids: CVE-2024-12728, CVE-2024-12727, CVE-2024-12729

Critical Path Traversal in FortiWLM (CVE-2023-34990) Permits Code Execution; Next.js Auth Bypass (CVE-2024-51479) - SOCRadar® Cyber Intelligence Inc.

Related entries in the VARIoT vulnerabilities database: VAR-202412-2453

Trust: 3.75

Fetched: Dec. 20, 2024, 9:37 a.m., Published: Dec. 19, 2024, 12:49 p.m.
 Vulnerabilities: authentication bypass, code execution, directory traversal...
Affected productsExternal IDs
db: NVD ids: CVE-2024-50570, CVE-2024-48889, CVE-2024-51479, CVE-2023-34990

Exploring vulnerable Windows drivers

Trust: 4.25

Fetched: Dec. 20, 2024, 9:34 a.m., Published: Dec. 19, 2024, 11:04 a.m.
 Vulnerabilities: code injection, process termination vulnerability, code execution...
Affected productsExternal IDs
vendor: cisco model: series
vendor: cisco model: guard
vendor: lenovo model: system
vendor: lenovo model: updates
vendor: trendmicro model: antivirus
vendor: trendmicro model: security
db: NVD ids: CVE-2024-1853, CVE-2022-3699

New Cyber Vulnerability in Schneider Electric Modicon Controllers: XSS Threat Analysis | Windows Forum

Related entries in the VARIoT vulnerabilities database: VAR-202407-0346

Trust: 4.5

Fetched: Dec. 20, 2024, 9:33 a.m., Published: May 20, 2024, midnight
 Vulnerabilities: cross-site scripting
Affected productsExternal IDs
vendor: schneider electric model: ecostruxure machine expert
vendor: schneider electric model: monitor
vendor: schneider model: ecostruxure machine expert
vendor: schneider model: monitor
db: NVD ids: CVE-2024-6528

ALAS-2024-2709

Trust: 3.75

Fetched: Dec. 20, 2024, 9:32 a.m., Published: Dec. 20, 2024, 1 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: opensc model: opensc
db: NVD ids: CVE-2024-45616, CVE-2024-45620, CVE-2024-45618, CVE-2024-45615, CVE-2024-45619, CVE-2024-45617

Breached but not broken.

Trust: 3.75

Fetched: Dec. 20, 2024, 9:32 a.m., Published: Dec. 1, 2024, midnight
 Vulnerabilities: default credentials
Affected productsExternal IDs
vendor: google model: chrome
vendor: google model: google chrome

US eyes ban on TP-Link routers amid cybersecurity concerns | CSO Online

Trust: 3.0

Fetched: Dec. 20, 2024, 9:32 a.m., Published: Dec. 19, 2024, midnight
 Vulnerabilities: -
Affected productsExternal IDs
vendor: tp-link model: routers

Redguard AG - Security Advisory: Multiple Vulnerabilities in the Open Source Software phpLDAPadmin

Trust: 4.75

Fetched: Dec. 20, 2024, 9:30 a.m., Published: Dec. 19, 2024, midnight
 Vulnerabilities: code injection, cross-site scripting
Affected productsExternal IDs
db: NVD ids: CVE-2024-9101

Tibbo AggreGate Network Manager | CISA

Trust: 4.5

Fetched: Dec. 20, 2024, 9:27 a.m., Published: Dec. 20, 2024, midnight
 Vulnerabilities: file upload vulnerability, code execution
Affected productsExternal IDs
vendor: trend model: security
vendor: tibbo model: aggregate
vendor: trend micro model: security
db: NVD ids: CVE-2024-12700

The Kia Vulnerability: A Wake-Up Call for IoT Security

Trust: 3.0

Fetched: Dec. 20, 2024, 9:26 a.m., Published: Dec. 3, 2024, midnight
 Vulnerabilities: -
Affected productsExternal IDs

Devices Running Microsoft Teams Allow for Buffer Overflow Vulnerability - Neat Support

Trust: 3.25

Fetched: Dec. 20, 2024, 9:25 a.m., Published: Dec. 19, 2024, 10:25 p.m.
 Vulnerabilities: buffer overflow
Affected productsExternal IDs

CVE-2023-3595, CVE-2023-3596: Rockwell Automation ControlLogix Vulnerabilities Disclosed - Blog | Tenable®

Related entries in the VARIoT vulnerabilities database: VAR-202307-1042, VAR-202307-1163

Trust: 5.25

Fetched: Dec. 20, 2024, 9:24 a.m., Published: July 12, 2023, 12:13 p.m.
 Vulnerabilities: denial of service, code execution
Affected productsExternal IDs
vendor: rockwell automation model: controllogix
vendor: rockwell automation model: automation allen-bradley controllogix
vendor: rockwell automation model: automation controllogix
vendor: rockwell model: controllogix
vendor: rockwell model: automation allen-bradley controllogix
vendor: rockwell model: automation controllogix
db: NVD ids: CVE-2023-3596, CVE-2023-3595

Mirion Technologies Telemetry Enabled Devices | CISA

Related entries in the VARIoT vulnerabilities database: VAR-201709-1107, VAR-201709-1106

Trust: 5.75

Fetched: Dec. 20, 2024, 9:23 a.m., Published: Dec. 20, 2024, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: mesh model: mesh
vendor: mirion technologies model: ipam transmitter f/dmc
vendor: mirion technologies model: external transmitters
vendor: mirion technologies model: rds-31 itx
vendor: mirion technologies model: drm-1/2
vendor: mirion technologies model: rsd31-am
vendor: mirion technologies model: dmc 3000
vendor: mirion technologies model: dmc 3000 transmitter module
vendor: mirion technologies model: ipam transmitter f/dmc 2000
vendor: mirion technologies model: telepole ii
vendor: mirion technologies model: dmc 3000 transmitter
vendor: mirion technologies model: mesh repeater
vendor: mirion technologies model: rds-31
vendor: mirion model: ipam transmitter f/dmc
vendor: mirion model: external transmitters
vendor: mirion model: rds-31 itx
vendor: mirion model: drm-1/2
vendor: mirion model: rsd31-am
vendor: mirion model: dmc 3000
vendor: mirion model: dmc 3000 transmitter module
vendor: mirion model: ipam transmitter f/dmc 2000
vendor: mirion model: telepole ii
vendor: mirion model: dmc 3000 transmitter
vendor: mirion model: mesh repeater
vendor: mirion model: rds-31
db: NVD ids: CVE-2017-9649, CVE-2017-9645

Yealink Device Management Command Injection Vulnerability

Trust: 4.0

Fetched: Dec. 20, 2024, 9:19 a.m., Published: -
 Vulnerabilities: command injection
Affected productsExternal IDs

Secure Endpoint Data Sheet - Cisco

Trust: 3.25

Fetched: Dec. 18, 2024, 9:56 a.m., Published: Dec. 11, 2024, 8:52 a.m.
 Vulnerabilities: privilege escalation, access violation
Affected productsExternal IDs
vendor: apple model: macos
vendor: google model: android
vendor: cisco model: service portal