Sign-up

VARIoT news about IoT security

The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter

Trust: 5.25

Fetched: Aug. 9, 2023, 9:33 a.m., Published: Aug. 2, 2023, noon
 Vulnerabilities: privilege escalation, command injection, information disclosure...
Affected productsExternal IDs
vendor: kcodes model: netusb
vendor: kcodes model: netusb.ko
vendor: asus model: asuswrt-merlin
vendor: asus model: router
vendor: asus model: asus
vendor: asus model: wireless routers
vendor: asus model: asuswrt
vendor: asus model: routers
vendor: asuswrt-merlin model: asuswrt-merlin
vendor: asuswrt-merlin model: router
vendor: asuswrt-merlin model: asus
vendor: asuswrt-merlin model: wireless routers
vendor: asuswrt-merlin model: asuswrt
vendor: asuswrt-merlin model: routers
vendor: synology model: router manager
vendor: synology model: synology router manager
vendor: cisco model: e1200
vendor: cisco model: series routers
vendor: cisco model: router
vendor: cisco model: small business
vendor: cisco model: industrial router
vendor: cisco model: e2500
vendor: cisco model: soho
vendor: cisco model: series
vendor: cisco model: linksys
vendor: cisco model: routers
vendor: netgear model: rbr750
vendor: netgear model: router
vendor: netgear model: multiple routers
vendor: netgear model: rbs750
vendor: netgear model: orbi
vendor: netgear model: r7900
vendor: netgear model: netusb.ko
vendor: netgear model: r8000
vendor: snort model: snort
vendor: tp-link model: tl-r600vpn
vendor: tp-link model: gateway
vendor: tp-link model: routers
vendor: mesh model: mesh
vendor: asuswrt model: asuswrt-merlin
vendor: asuswrt model: router
vendor: asuswrt model: asus
vendor: asuswrt model: wireless routers
vendor: asuswrt model: asuswrt
vendor: asuswrt model: routers
vendor: d-link model: router
vendor: d-link model: multiple routers
vendor: d-link model: dir-3040
vendor: linksys model: e1200
vendor: linksys model: e2500

CVE-2023-35082 - MobileIron Core Unauthenticated API Access Vulnerability | Rapid7 Blog

Trust: 3.0

Fetched: Aug. 9, 2023, 9:32 a.m., Published: Aug. 2, 2023, 4:05 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2023-35078, CVE-2023-35082, CVE-2023-35081

OpenText Archive Center Administration Client XXE Vulnerability | WithSecure™ Labs

Trust: 3.75

Fetched: Aug. 9, 2023, 9:32 a.m., Published: Jan. 10, 2022, midnight
 Vulnerabilities: denial of service, injection attack
Affected productsExternal IDs

Complex RCE Vulnerability (CVE-2023-39143) in PaperCut Application Servers

Trust: 4.25

Fetched: Aug. 9, 2023, 9:31 a.m., Published: Aug. 7, 2023, 6:54 p.m.
 Vulnerabilities: denial of service, code execution, path traversal
Affected productsExternal IDs
vendor: trend model: security
vendor: trend micro model: security
db: NVD ids: CVE-2023-27350, CVE-2023-3486, CVE-2023-39143

PaperCut fixes bug that can lead to RCE, patch quickly! (CVE-2023-39143) - Help Net Security

Trust: 5.5

Fetched: Aug. 9, 2023, 9:30 a.m., Published: Aug. 7, 2023, 10:41 a.m.
 Vulnerabilities: code execution, path traversal
Affected productsExternal IDs
vendor: trend model: security
vendor: trend micro model: security
db: NVD ids: CVE-2023-27350, CVE-2023-3486, CVE-2023-39143

July-2023-HarmonyOS Security Bulletins-Updates-HarmonyOSDevice

Related entries in the VARIoT vulnerabilities database: VAR-202201-1068, VAR-202201-1063, VAR-202201-1730

Trust: 5.5

Fetched: Aug. 9, 2023, 9:24 a.m., Published: -
 Vulnerabilities: privilege escalation, format string vulnerability, buffer overflow...
Affected productsExternal IDs
vendor: huawei model: huawei
db: NVD ids: CVE-2023-34164, CVE-2021-40032, CVE-2023-37240, CVE-2022-48516, CVE-2022-48520, CVE-2022-48512, CVE-2022-48513, CVE-2022-48514, CVE-2023-1695, CVE-2021-46894, CVE-2022-48511, CVE-2021-40027, CVE-2023-37238, CVE-2021-46892, CVE-2022-48518, CVE-2022-48507, CVE-2022-48515, CVE-2021-46893, CVE-2022-48517, CVE-2022-48509, CVE-2023-1691, CVE-2023-37239, CVE-2023-37245, CVE-2021-46890, CVE-2022-48510, CVE-2021-40014, CVE-2022-48519, CVE-2023-3455, CVE-2023-37241, CVE-2021-46891, CVE-2023-3456, CVE-2022-48508, CVE-2023-37242

2022 Top Routinely Exploited Vulnerabilities | CISA

Related entries in the VARIoT vulnerabilities database: VAR-202205-0394, VAR-202212-1132, VAR-202112-0361, VAR-202102-0898, VAR-202110-1690, VAR-202008-0248, VAR-202210-0198, VAR-202206-0004, VAR-201906-0815, VAR-202110-1691, VAR-202112-0562, VAR-202207-0874, VAR-202109-1802, VAR-202202-1358, VAR-202205-1958, VAR-202007-1393, VAR-202104-0755

Trust: 5.25

Fetched: Aug. 9, 2023, 9:22 a.m., Published: Aug. 9, 2022, midnight
 Vulnerabilities: privilege escalation, security feature bypass, sql injection...
Affected productsExternal IDs
vendor: zoho model: manageengine adselfservice plus
vendor: citrix model: sd-wan
vendor: citrix model: netscaler adc
vendor: citrix model: application delivery controller
vendor: citrix model: netscaler gateway
vendor: citrix model: sd-wan wanop
vendor: citrix model: netscaler
vendor: citrix model: gateway
vendor: sonicwall model: ssl-vpn
vendor: sonicwall model: email security
vendor: sonicwall model: sma 100
vendor: sonicwall model: sma100
vendor: sonicwall model: analyzer
vendor: sonicwall model: ssl vpn
vendor: pulse secure model: policy secure
vendor: pulse secure model: connect secure
vendor: pulse secure model: pulse connect secure
vendor: pulse secure model: pulse policy secure
vendor: pulse model: secure pulse connect secure
vendor: wso2 model: application server
vendor: wso2 model: enterprise integrator
vendor: wso2 model: identity server
vendor: wso2 model: wso2 enterprise integrator
vendor: wso2 model: wso2 identity server
vendor: wso2 model: api manager
vendor: wso2 model: identity server analytics
vendor: wso2 model: wso2 api manager
vendor: qnap model: photo station
db: NVD ids: CVE-2022-22954, CVE-2022-1388, CVE-2021-26855, CVE-2022-42475, CVE-2021-34523, CVE-2021-20038, CVE-2021-26084, CVE-2022-22960, CVE-2021-20016, CVE-2021-26858, CVE-2019-11510, CVE-2019-0708, CVE-2021-42013, CVE-2020-1472, CVE-2022-40684, CVE-2022-26134, CVE-2019-19781, CVE-2021-27065, CVE-2018-13379, CVE-2021-26857, CVE-2020-14883, CVE-2021-41773, CVE-2022-29464, CVE-2022-27924, CVE-2021-45046, CVE-2022-27593, CVE-2017-11882, CVE-2021-40539, CVE-2022-22963, CVE-2022-24682, CVE-2022-41082, CVE-2017-0199, CVE-2022-22047, CVE-2021-40438, CVE-2021-31207, CVE-2021-34473, CVE-2022-22536, CVE-2022-30190, CVE-2020-14882, CVE-2020-5902, CVE-2021-20021

Ivanti patches second zero-day vulnerability being used in attacks

Trust: 3.25

Fetched: Aug. 9, 2023, 9:22 a.m., Published: -
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2023-35078, CVE-2023-35081

August

Related entries in the VARIoT vulnerabilities database: VAR-202112-0949, VAR-202307-0110, VAR-202303-2113

Trust: 4.5

Fetched: Aug. 9, 2023, 9:21 a.m., Published: Aug. 4, 2023, 5:15 p.m.
 Vulnerabilities: information leakage, input verification vulnerability, privilege escalation
Affected productsExternal IDs
vendor: huawei model: emui
vendor: huawei model: huawei
db: NVD ids: CVE-2023-21180, CVE-2023-39403, CVE-2023-39389, CVE-2021-40006, CVE-2023-39381, CVE-2023-39405, CVE-2023-21185, CVE-2023-39402, CVE-2023-20985, CVE-2023-39398, CVE-2023-20981, CVE-2023-21202, CVE-2023-22386, CVE-2023-21196, CVE-2023-39390, CVE-2023-21167, CVE-2023-21175, CVE-2023-20986, CVE-2023-39395, CVE-2023-28541, CVE-2023-21193, CVE-2022-42703, CVE-2023-21145, CVE-2023-21199, CVE-2023-39393, CVE-2023-21201, CVE-2023-21246, CVE-2023-39385, CVE-2023-20977, CVE-2023-39401, CVE-2023-39397, CVE-2022-20199, CVE-2023-21172, CVE-2023-21238, CVE-2023-21250, CVE-2023-20987, CVE-2021-46895, CVE-2023-39394, CVE-2023-20980, CVE-2021-0948, CVE-2023-39392, CVE-2023-28542, CVE-2023-21241, CVE-2023-39383, CVE-2023-39399, CVE-2023-20979, CVE-2023-21173, CVE-2023-20983, CVE-2023-20982, CVE-2023-20973, CVE-2023-39386, CVE-2023-20989, CVE-2023-39400, CVE-2023-21168, CVE-2023-39396, CVE-2022-27405, CVE-2023-20988, CVE-2023-39406, CVE-2023-39382, CVE-2023-39388, CVE-2023-39404, CVE-2023-39380, CVE-2023-20990, CVE-2022-27406, CVE-2023-39387, CVE-2023-20918, CVE-2023-39391, CVE-2023-39384, CVE-2023-20974

August

Related entries in the VARIoT vulnerabilities database: VAR-202112-0949, VAR-202307-0110, VAR-202303-2113

Trust: 4.5

Fetched: Aug. 9, 2023, 9:21 a.m., Published: Aug. 4, 2023, 4:37 p.m.
 Vulnerabilities: information leakage, input verification vulnerability, privilege escalation
Affected productsExternal IDs
vendor: huawei model: emui
vendor: huawei model: huawei
db: NVD ids: CVE-2023-21180, CVE-2023-39403, CVE-2023-39389, CVE-2021-40006, CVE-2023-39381, CVE-2023-39405, CVE-2023-21185, CVE-2023-39402, CVE-2023-20985, CVE-2023-39398, CVE-2023-20981, CVE-2023-21202, CVE-2023-22386, CVE-2023-21196, CVE-2023-39390, CVE-2023-21167, CVE-2023-21175, CVE-2023-20986, CVE-2023-39395, CVE-2023-28541, CVE-2023-21193, CVE-2022-42703, CVE-2023-21145, CVE-2023-21199, CVE-2023-39393, CVE-2023-21201, CVE-2023-21246, CVE-2023-39385, CVE-2023-20977, CVE-2023-39401, CVE-2023-39397, CVE-2022-20199, CVE-2023-21172, CVE-2023-21238, CVE-2023-21250, CVE-2023-20987, CVE-2021-46895, CVE-2023-39394, CVE-2023-20980, CVE-2021-0948, CVE-2023-39392, CVE-2023-28542, CVE-2023-21241, CVE-2023-39383, CVE-2023-39399, CVE-2023-20979, CVE-2023-21173, CVE-2023-20983, CVE-2023-20982, CVE-2023-20973, CVE-2023-39386, CVE-2023-20989, CVE-2023-39400, CVE-2023-21168, CVE-2023-39396, CVE-2022-27405, CVE-2023-20988, CVE-2023-39406, CVE-2023-39382, CVE-2023-39388, CVE-2023-39404, CVE-2023-39380, CVE-2023-20990, CVE-2022-27406, CVE-2023-39387, CVE-2023-20918, CVE-2023-39391, CVE-2023-39384, CVE-2023-20974

August

Related entries in the VARIoT vulnerabilities database: VAR-202112-0949, VAR-202307-0110, VAR-202303-2113

Trust: 4.5

Fetched: Aug. 9, 2023, 9:20 a.m., Published: Aug. 4, 2023, 4:08 p.m.
 Vulnerabilities: information leakage, input verification vulnerability, privilege escalation
Affected productsExternal IDs
vendor: huawei model: emui
vendor: huawei model: huawei
db: NVD ids: CVE-2023-21180, CVE-2023-39403, CVE-2023-39389, CVE-2021-40006, CVE-2023-39381, CVE-2023-39405, CVE-2023-21185, CVE-2023-39402, CVE-2023-20985, CVE-2023-39398, CVE-2023-20981, CVE-2023-21202, CVE-2023-22386, CVE-2023-21196, CVE-2023-39390, CVE-2023-21167, CVE-2023-21175, CVE-2023-20986, CVE-2023-39395, CVE-2023-28541, CVE-2023-21193, CVE-2022-42703, CVE-2023-21145, CVE-2023-21199, CVE-2023-39393, CVE-2023-21201, CVE-2023-21246, CVE-2023-39385, CVE-2023-20977, CVE-2023-39401, CVE-2023-39397, CVE-2022-20199, CVE-2023-21172, CVE-2023-21238, CVE-2023-21250, CVE-2023-20987, CVE-2021-46895, CVE-2023-39394, CVE-2023-20980, CVE-2021-0948, CVE-2023-39392, CVE-2023-28542, CVE-2023-21241, CVE-2023-39383, CVE-2023-39399, CVE-2023-20979, CVE-2023-21173, CVE-2023-20983, CVE-2023-20982, CVE-2023-20973, CVE-2023-39386, CVE-2023-20989, CVE-2023-39400, CVE-2023-21168, CVE-2023-39396, CVE-2022-27405, CVE-2023-20988, CVE-2023-39406, CVE-2023-39382, CVE-2023-39388, CVE-2023-39404, CVE-2023-39380, CVE-2023-20990, CVE-2022-27406, CVE-2023-39387, CVE-2023-20918, CVE-2023-39391, CVE-2023-39384, CVE-2023-20974

August

Related entries in the VARIoT vulnerabilities database: VAR-202112-0949, VAR-202307-0110, VAR-202303-2113

Trust: 4.5

Fetched: Aug. 9, 2023, 9:20 a.m., Published: Aug. 4, 2023, 4:39 p.m.
 Vulnerabilities: information leakage, input verification vulnerability, privilege escalation
Affected productsExternal IDs
vendor: huawei model: emui
vendor: huawei model: huawei
db: NVD ids: CVE-2023-21180, CVE-2023-39403, CVE-2023-39389, CVE-2021-40006, CVE-2023-39381, CVE-2023-39405, CVE-2023-21185, CVE-2023-39402, CVE-2023-20985, CVE-2023-39398, CVE-2023-20981, CVE-2023-21202, CVE-2023-22386, CVE-2023-21196, CVE-2023-39390, CVE-2023-21167, CVE-2023-21175, CVE-2023-20986, CVE-2023-39395, CVE-2023-28541, CVE-2023-21193, CVE-2022-42703, CVE-2023-21145, CVE-2023-21199, CVE-2023-39393, CVE-2023-21201, CVE-2023-21246, CVE-2023-39385, CVE-2023-20977, CVE-2023-39401, CVE-2023-39397, CVE-2022-20199, CVE-2023-21172, CVE-2023-21238, CVE-2023-21250, CVE-2023-20987, CVE-2021-46895, CVE-2023-39394, CVE-2023-20980, CVE-2021-0948, CVE-2023-39392, CVE-2023-28542, CVE-2023-21241, CVE-2023-39383, CVE-2023-39399, CVE-2023-20979, CVE-2023-21173, CVE-2023-20983, CVE-2023-20982, CVE-2023-20973, CVE-2023-39386, CVE-2023-20989, CVE-2023-39400, CVE-2023-21168, CVE-2023-39396, CVE-2022-27405, CVE-2023-20988, CVE-2023-39406, CVE-2023-39382, CVE-2023-39388, CVE-2023-39404, CVE-2023-39380, CVE-2023-20990, CVE-2022-27406, CVE-2023-39387, CVE-2023-20918, CVE-2023-39391, CVE-2023-39384, CVE-2023-20974

Ghostscript Remote Code Execution Vulnerability | Kroll

Trust: 3.75

Fetched: Aug. 9, 2023, 9:19 a.m., Published: July 11, 2023, midnight
 Vulnerabilities: code execution
Affected productsExternal IDs
db: NVD ids: CVE-2023-36664

Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities

Trust: 5.25

Fetched: Aug. 9, 2023, 9:19 a.m., Published: July 11, 2023, 4:43 p.m.
 Vulnerabilities: cross-site scripting
Affected productsExternal IDs

KB5028407: How to manage the vulnerability associated with CVE-2023-32019 - Microsoft Support

Trust: 4.25

Fetched: Aug. 9, 2023, 9:18 a.m., Published: June 13, 2023, midnight
 Vulnerabilities: information disclosure
Affected productsExternal IDs
db: NVD ids: CVE-2023-32019

Ordr Security Bulletin: MOVEit Vulnerabilities - Ordr

Trust: 4.5

Fetched: Aug. 8, 2023, 9:34 a.m., Published: June 19, 2023, 2:37 p.m.
 Vulnerabilities: sql injection
Affected productsExternal IDs
vendor: ipswitch model: moveit transfer
vendor: check point model: check point
db: NVD ids: CVE-2023-34362

Cybersecurity Threat Advisory: Critical PaperCut vulnerability actively exploited

Trust: 6.0

Fetched: Aug. 8, 2023, 9:34 a.m., Published: May 9, 2023, 7:47 p.m.
 Vulnerabilities: code execution, improper access control, authentication bypass
Affected productsExternal IDs
vendor: barracuda model: barracuda
db: NVD ids: CVE-2023-27350

iPrint&Scan App Vulnerability on Android™ Devices | Brother

Trust: 4.0

Fetched: Aug. 8, 2023, 9:33 a.m., Published: Aug. 1, 2023, midnight
 Vulnerabilities: -
Affected productsExternal IDs
vendor: google model: android
db: NVD ids: CVE-2023-28369

Final OT:ICEFALL vulnerability disclosed affecting Schneider tool

Related entries in the VARIoT vulnerabilities database: VAR-202305-2074

Trust: 3.75

Fetched: Aug. 8, 2023, 9:32 a.m., Published: June 21, 2023, midnight
 Vulnerabilities: -
Affected productsExternal IDs
vendor: motorola model: motorola
db: NVD ids: CVE-2022-46680

DeviceTvmInfoGathering table in the advanced hunting schema | Microsoft Learn

Related entries in the VARIoT vulnerabilities database: VAR-202112-0566

Trust: 3.0

Fetched: Aug. 8, 2023, 9:31 a.m., Published: June 22, 2022, midnight
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2021-44228