Sign-up

VARIoT news about IoT security

Apple patches exploited zero-days | SC Media

Trust: 5.75

Fetched: Aug. 1, 2023, 9:19 a.m., Published: June 22, 2023, 1:22 a.m.
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: apple model: ipod touch
vendor: apple model: macos
vendor: apple model: ipad air
vendor: apple model: webkit
vendor: apple model: ipad
vendor: apple model: iphone
db: NVD ids: CVE-2023-32435, CVE-2023-32439, CVE-2023-32434

Samsung Smartphone Users Warned of Actively Exploited Vulnerability - SecurityWeek

Related entries in the VARIoT vulnerabilities database: VAR-201609-0325, VAR-200412-0177

Trust: 3.75

Fetched: Aug. 1, 2023, 9:19 a.m., Published: May 22, 2023, 9:07 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: cisco model: guard
vendor: cisco model: cisco ios
vendor: samsung model: mobile
vendor: samsung model: mobile devices
vendor: google model: android
db: NVD ids: CVE-2023-21492, CVE-2016-6415, CVE-2004-1464

Cisco Warns of Vulnerability in Popular Phone Adapter, Urges Migration to Newer Model

Trust: 3.75

Fetched: Aug. 1, 2023, 9:17 a.m., Published: May 5, 2023, 5:16 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: cisco model: series
vendor: cisco model: spa112
db: NVD ids: CVE-2023-20126

CISA Warning! 8 Actively Exploited Flaws in Samsung and D-Link Devices

Related entries in the VARIoT vulnerabilities database: VAR-202003-0963, VAR-201912-1012, VAR-202103-1332, VAR-202110-0167, VAR-202110-0169

Trust: 4.5

Fetched: Aug. 1, 2023, 9:17 a.m., Published: July 5, 2023, 8:38 a.m.
 Vulnerabilities: command injection, kernel panic, input validation vulnerability...
Affected productsExternal IDs
vendor: d-link model: dwl-2600ap
vendor: d-link model: dir-859
vendor: d-link model: router
db: NVD ids: CVE-2019-20500, CVE-2021-25395, CVE-2019-17621, CVE-2021-25372, CVE-2021-25487, CVE-2021-25489, CVE-2021-25371, CVE-2021-25394

PoC Exploit Published for Recent Ubiquiti EdgeRouter Vulnerability - SecurityWeek

Trust: 3.0

Fetched: Aug. 1, 2023, 9:17 a.m., Published: July 10, 2023, 11:27 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2023-31998

CVE-2023-27997: Fortinet Fortigate SSL VPN Pre-Auth RCE critical vulnerability

Trust: 5.5

Fetched: Aug. 1, 2023, 9:16 a.m., Published: June 16, 2023, 9:29 a.m.
 Vulnerabilities: denial of service, buffer overflow
Affected productsExternal IDs
vendor: fortigate model: fortios
db: NVD ids: CVE-2023-27997

CVE-2023-20126- A Critical RCE Vulnerability in Cisco SPA112 2-Port Phone Adapter - The Sec Master

Trust: 5.5

Fetched: Aug. 1, 2023, 9:16 a.m., Published: May 8, 2023, 10:30 a.m.
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: cisco model: spa112 2-port phone adapter
vendor: cisco model: series
vendor: cisco model: spa112
vendor: cisco model: router
vendor: cisco model: spa122
db: NVD ids: CVE-2023-20126

Kaspersky research: vulnerabilities in smart pet feeders | Securelist

Trust: 3.25

Fetched: Aug. 1, 2023, 9:15 a.m., Published: Jan. 1, 2050, midnight
 Vulnerabilities: memory corruption, denial of service
Affected productsExternal IDs

Cisco Small Business 200, 300, and 500 Series Switches Web-Based Management Stored Cross-Site Scripting Vulnerability

Trust: 4.0

Fetched: Aug. 1, 2023, 9:15 a.m., Published: June 7, 2023, 3:56 p.m.
 Vulnerabilities: cross-site scripting
Affected productsExternal IDs
vendor: cisco model: 500 series stackable managed switches
vendor: cisco model: 300 series managed switches
vendor: cisco model: series managed switches
vendor: cisco model: small business
vendor: cisco model: series switches
vendor: cisco model: 200 series smart switches
vendor: cisco model: series
vendor: cisco model: series smart switches
vendor: cisco model: small business 500 series stackable managed switches
vendor: cisco model: small business 300 series managed switches
vendor: cisco model: cisco small business
vendor: cisco model: series stackable managed switches

CISA Says Critical Zyxel NAS Vulnerability Exploited in Attacks - SecurityWeek

Trust: 5.5

Fetched: Aug. 1, 2023, 9:14 a.m., Published: June 26, 2023, midnight
 Vulnerabilities: command injection, command execution
Affected productsExternal IDs
vendor: zyxel model: nas542
vendor: zyxel model: nas540
vendor: zyxel model: nas326
db: NVD ids: CVE-2023-27992

Critical Severity Vulnerability in Fortinet Fortigate SSL-VPN Devices - Australian Cyber Security Magazine

Trust: 6.0

Fetched: Aug. 1, 2023, 9:14 a.m., Published: June 14, 2023, 1:18 a.m.
 Vulnerabilities: code execution
Affected productsExternal IDs
vendor: fortigate model: fortios
db: NVD ids: CVE-2023-27997

CVE-2023-35078 - New Ivanti EPMM Vulnerability

Trust: 3.25

Fetched: Aug. 1, 2023, 9:14 a.m., Published: July 24, 2023, midnight
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2023-35078

Code Execution Vulnerability Impacts 900k MikroTik Devices - SecurityWeek

Trust: 4.5

Fetched: Aug. 1, 2023, 9:13 a.m., Published: July 26, 2023, 11:48 a.m.
 Vulnerabilities: privilege escalation, code execution
Affected productsExternal IDs
vendor: mikrotik model: mikrotik routers
vendor: mikrotik model: routeros
vendor: mikrotik model: winbox
vendor: mikrotik model: routers
vendor: snort model: snort
db: NVD ids: CVE-2023-30799

Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability - Cisco

Trust: 4.75

Fetched: Aug. 1, 2023, 9:13 a.m., Published: May 3, 2023, 11:11 a.m.
 Vulnerabilities: command execution
Affected productsExternal IDs
vendor: cisco model: spa112 2-port phone adapter
vendor: cisco model: router
vendor: cisco model: spa122
vendor: cisco model: spa112

Apple fixes zero-day vulnerabilities used to covertly deliver spyware (CVE-2023-32435) - Help Net Security

Trust: 5.5

Fetched: Aug. 1, 2023, 9:12 a.m., Published: June 22, 2023, 10:23 a.m.
 Vulnerabilities: memory corruption, integer overflow, code execution
Affected productsExternal IDs
vendor: apple model: macos
vendor: apple model: webkit
db: NVD ids: CVE-2023-32435, CVE-2023-32439, CVE-2023-32434

New OpenSSH Vulnerability Exposes Linux Systems to Remote Command Injection

Trust: 5.0

Fetched: July 28, 2023, 9:13 a.m., Published: July 24, 2023, 9:10 a.m.
 Vulnerabilities: remote command injection, code execution, command injection
Affected productsExternal IDs
db: NVD ids: CVE-2023-38408, CVE-2023-25136

Patch now! Ivanti Endpoint Manager Mobile Authentication vulnerability used in the wild

Trust: 4.75

Fetched: July 28, 2023, 9:13 a.m., Published: July 27, 2023, 3:16 p.m.
 Vulnerabilities: authentication vulnerability, authentication bypass
Affected productsExternal IDs
db: NVD ids: CVE-2023-35078

Vulnerability in QVPN Device Client for Windows - Security Advisory | QNAP (UK)

Trust: 3.25

Fetched: July 28, 2023, 9:12 a.m., Published: May 6, 2023, midnight
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2022-27595

Critical MikroTik RouterOS Vulnerability Exposes Over Half a Million Devices to Hacking

Trust: 4.75

Fetched: July 26, 2023, 9:13 a.m., Published: July 26, 2023, 5:02 a.m.
 Vulnerabilities: privilege escalation
Affected productsExternal IDs
vendor: mikrotik model: routers
vendor: mikrotik model: router
vendor: mikrotik model: winbox
vendor: mikrotik model: mikrotik routers
vendor: mikrotik model: routeros
vendor: snort model: snort
db: NVD ids: CVE-2023-30799

Ivanti Releases Urgent Patch for EPMM Zero-Day Vulnerability Under Active Exploitation

Trust: 4.0

Fetched: July 26, 2023, 9:13 a.m., Published: July 25, 2023, 3:51 a.m.
 Vulnerabilities: authentication bypass
Affected productsExternal IDs
db: NVD ids: CVE-2023-35078