Sign-up

VARIoT news about IoT security

3.28 Million Fortinet Devices at Risk Due to Exposed Web Properties

Trust: 4.25

Fetched: Jan. 30, 2026, 9:24 a.m., Published: Jan. 30, 2026, 6:35 a.m.
 Vulnerabilities: authentication bypass
Affected productsExternal IDs
db: NVD ids: CVE-2026-24858

Ivanti Patches Two Exploited Zero-Days In Mobile Manager

Trust: 4.75

Fetched: Jan. 30, 2026, 9:23 a.m., Published: Jan. 30, 2026, 8:51 a.m.
 Vulnerabilities: code injection
Affected productsExternal IDs
db: NVD ids: CVE-2026-1340, CVE-2026-1281

TP-Link Archer Router Flaw Exposes Users to Remote Attacks and Full Device Control

Trust: 6.0

Fetched: Jan. 30, 2026, 9:23 a.m., Published: Jan. 28, 2026, 11:10 a.m.
 Vulnerabilities: command injection
Affected productsExternal IDs
vendor: google model: home
db: NVD ids: CVE-2025-14756

Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858 | CISA

Trust: 6.0

Fetched: Jan. 30, 2026, 9:22 a.m., Published: -
 Vulnerabilities: authentication bypass
Affected productsExternal IDs
vendor: fortigate model: fortios
db: NVD ids: CVE-2025-59719, CVE-2025-59718, CVE-2026-24858

Zyxel Issues Emergency Security Patches for Critical NAS Device Vulnerability - Breach Spot

Trust: 5.75

Fetched: Jan. 30, 2026, 9:21 a.m., Published: Jan. 29, 2026, 7:30 a.m.
 Vulnerabilities: command injection
Affected productsExternal IDs
vendor: zyxel model: nas542
vendor: zyxel model: nas326
vendor: zyxel model: nas540
vendor: trend model: security
db: NVD ids: CVE-2023-27992

Experts flag around 800,000 Telnet servers exposed to remote attacks - here's why users should be on their guard | TechRadar

Trust: 4.25

Fetched: Jan. 30, 2026, 9:20 a.m., Published: Jan. 27, 2026, 2:15 p.m.
 Vulnerabilities: authentication bypass
Affected productsExternal IDs
db: NVD ids: CVE-2026-24061

TP-Link Archer C6 Router Vulnerabilities Exposed | Enigma Security posted on the topic | LinkedIn

Trust: 3.5

Fetched: Jan. 28, 2026, 9:30 a.m., Published: -
 Vulnerabilities: code execution, command injection
Affected productsExternal IDs
vendor: tp-link model: routers
vendor: tplink model: routers

Analyzing CVE-2025-71024: Understanding and Mitigating Tenda AX-3 Stack Overflow Vulnerability

Related entries in the VARIoT vulnerabilities database: VAR-202601-1487

Trust: 5.75

Fetched: Jan. 28, 2026, 9:26 a.m., Published: Jan. 3, 2026, midnight
 Vulnerabilities: denial of service, code execution
Affected productsExternal IDs
vendor: tenda model: router
db: NVD ids: CVE-2025-71024

Update Canonical Ubuntu Desktop: USN-7978-1: GNU Screen vulnerabilities

Trust: 6.0

Fetched: Jan. 28, 2026, 9:25 a.m., Published: Jan. 28, 7978, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: canonical model: ubuntu
db: NVD ids: CVE-2025-46804, CVE-2023-24626, CVE-2025-46805, CVE-2025-46802

Update Canonical Ubuntu Server: USN-7970-1: iperf3 vulnerabilities

Trust: 6.0

Fetched: Jan. 28, 2026, 9:25 a.m., Published: Jan. 28, 7970, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: canonical model: ubuntu
db: NVD ids: CVE-2024-53580, CVE-2025-54349, CVE-2023-7250, CVE-2025-54350, CVE-2024-26306

Telegram Vulnerability Exposed: Android Users at Risk | Luis Oria Seidel posted on the topic | LinkedIn

Trust: 4.25

Fetched: Jan. 28, 2026, 9:24 a.m., Published: -
 Vulnerabilities: traffic interception
Affected productsExternal IDs
vendor: wireshark model: wireshark

Fortinet Zero-Day: FortiCloud SSO Authentication Bypass (CVE-2026-24858) Under Active Exploitation

Trust: 4.75

Fetched: Jan. 28, 2026, 9:23 a.m., Published: Jan. 28, 2026, midnight
 Vulnerabilities: authentication bypass
Affected productsExternal IDs
db: NVD ids: CVE-2026-24858

Update Canonical Ubuntu Desktop: USN-7977-1: Git LFS vulnerabilities

Trust: 4.0

Fetched: Jan. 28, 2026, 9:23 a.m., Published: Jan. 28, 7977, midnight
 Vulnerabilities: -
Affected productsExternal IDs
vendor: canonical model: ubuntu
db: NVD ids: CVE-2025-26625, CVE-2024-53263

Router Takeover: High-Severity Command Injection Flaw Hits TP-Link Archer MR600

Trust: 5.0

Fetched: Jan. 28, 2026, 9:23 a.m., Published: Jan. 28, 2026, 12:16 a.m.
 Vulnerabilities: weak password, command injection, default credentials...
Affected productsExternal IDs
db: NVD ids: CVE-2025-14756

"New" Path of Attack: Fully Upgraded Fortinet Devices Hit by SSO Exploits

Trust: 3.0

Fetched: Jan. 28, 2026, 9:22 a.m., Published: Jan. 23, 2026, 4:34 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-59718, CVE-2025-59719

Update Canonical Ubuntu Server: USN-7972-1: OpenCC vulnerability

Trust: 4.0

Fetched: Jan. 28, 2026, 9:22 a.m., Published: Jan. 28, 7972, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: canonical model: ubuntu

Update Canonical Ubuntu Desktop: USN-7975-1: pyasn1 vulnerability

Trust: 4.25

Fetched: Jan. 28, 2026, 9:21 a.m., Published: Jan. 28, 7975, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: canonical model: ubuntu

Update Canonical Ubuntu Server: USN-7975-1: pyasn1 vulnerability

Trust: 4.25

Fetched: Jan. 28, 2026, 9:21 a.m., Published: Jan. 28, 7975, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: canonical model: ubuntu

Update Canonical Ubuntu Server: USN-7971-1: GLib vulnerability

Trust: 4.25

Fetched: Jan. 28, 2026, 9:21 a.m., Published: Jan. 28, 7971, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: canonical model: ubuntu

U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog

Related entries in the VARIoT vulnerabilities database: VAR-201809-0668

Trust: 4.75

Fetched: Jan. 28, 2026, 9:21 a.m., Published: Jan. 27, 2026, 2:54 p.m.
 Vulnerabilities: feature bypass, security feature bypass, authentication bypass...
Affected productsExternal IDs
db: NVD ids: CVE-2026-23760, CVE-2025-52691, CVE-2018-14634, CVE-2026-21509, CVE-2026-24061