VARIoT latest news about IoT security

Windows GDI Vulnerability in Rust Kernel Module Enables Remote Attacks Trust: 3.75 Fetched: Oct. 19, 2025, 9:36 a.m., Published: Oct. 17, 2025, 9:46 a.m.	Vulnerabilities: denial of service

Affected products

External IDs

vendor:	check point	model:	check point
vendor:	google	model:	home

Surface Laptop Studio September 2025 update is now live Trust: 4.75 Fetched: Oct. 19, 2025, 9:35 a.m., Published: Sept. 30, 2025, 4 a.m.	Vulnerabilities: denial of service, information disclosure

Affected products

External IDs

db:

NVD

ids:

CVE-2022-38102, CVE-2022-36392

CVE-2023-53658 \| Armis Vulnerability Intelligence Database Trust: 3.0 Fetched: Oct. 19, 2025, 9:33 a.m., Published: Oct. 7, 2025, 4:15 p.m.	Vulnerabilities: code execution

Affected products

External IDs

db:

NVD

ids:

CVE-2023-53658

CVE-2025-10961 \| Armis Vulnerability Intelligence Database Trust: 4.0 Fetched: Oct. 19, 2025, 9:33 a.m., Published: Sept. 25, 2025, 6:15 p.m.	Vulnerabilities: command injection

Affected products

External IDs

db:

NVD

ids:

CVE-2025-10961

CVE-2025-10653 \| Armis Vulnerability Intelligence Database Trust: 3.25 Fetched: Oct. 19, 2025, 9:33 a.m., Published: Oct. 2, 2025, 8:15 p.m.	Vulnerabilities: authentication bypass

Affected products

External IDs

db:

NVD

ids:

CVE-2025-10653

WatchGuard Fireware OS Hit by Critical CVE-2025-9242 RCE Vulnerability Trust: 4.75 Fetched: Oct. 19, 2025, 9:31 a.m., Published: Oct. 18, 2025, 5:25 p.m.	Vulnerabilities: code injection

Affected products

External IDs

vendor:	watchguard	model:	watchguard fireware
vendor:	watchguard	model:	firebox
vendor:	watchguard	model:	fireware

db:

NVD

ids:

CVE-2025-9242

Vulnerabilities Allow Disruption of Phoenix Contact UPS Devices Trust: 4.0 Fetched: Oct. 19, 2025, 9:31 a.m., Published: Oct. 17, 2025, 8:30 a.m.	Vulnerabilities: information leakage

Affected products

External IDs

db:

NVD

ids:

CVE-2025-41703, CVE-2025-41705, CVE-2025-41707, CVE-2025-41704, CVE-2025-41706

CVE-2025-10964 \| Armis Vulnerability Intelligence Database Trust: 3.0 Fetched: Oct. 19, 2025, 9:31 a.m., Published: Sept. 25, 2025, 8:15 p.m.	Vulnerabilities: command injection, service disruption

Affected products

External IDs

db:

NVD

ids:

CVE-2025-10964

Hackers used Cisco zero-day to plant rootkits on network switches (CVE-2025-20352) - Help Net Security Related entries in the VARIoT vulnerabilities database: VAR-201703-0892 Trust: 5.5 Fetched: Oct. 19, 2025, 9:30 a.m., Published: Oct. 17, 2025, 12:29 p.m.	Vulnerabilities: code execution, authentication bypass

Affected products

External IDs

vendor:	cisco	model:	ios xe
vendor:	cisco	model:	cisco ios
vendor:	cisco	model:	ios xe software
vendor:	cisco	model:	series
vendor:	trend	model:	security
vendor:	trend micro	model:	security

db:

NVD

ids:

CVE-2025-20352, CVE-2017-3881

CVE-2025-10959 \| Armis Vulnerability Intelligence Database Trust: 4.0 Fetched: Oct. 19, 2025, 9:30 a.m., Published: Sept. 25, 2025, 6:15 p.m.	Vulnerabilities: command injection

Affected products

External IDs

db:

NVD

ids:

CVE-2025-10959

CVE-2025-10960 \| Armis Vulnerability Intelligence Database Trust: 3.0 Fetched: Oct. 19, 2025, 9:30 a.m., Published: Sept. 25, 2025, 6:15 p.m.	Vulnerabilities: command injection

Affected products

External IDs

db:

NVD

ids:

CVE-2025-10960

Researchers Uncover WatchGuard VPN Bug That Could Let Attackers Take Over Devices Trust: 5.5 Fetched: Oct. 19, 2025, 9:27 a.m., Published: Oct. 17, 2025, 9:25 a.m.	Vulnerabilities: command injection, command execution, code execution

Affected products

External IDs

vendor:	watchguard	model:	watchguard fireware
vendor:	watchguard	model:	fireware

db:

NVD

ids:

CVE-2025-36604, CVE-2025-3600, CVE-2025-9242

CVE-2025-6892, CVE-2025-6893, CVE-2025-6894, CVE-2025-6949, CVE-2025-6950: Multiple Vulnerabilities in Network Security Appliances and Routers Trust: 3.75 Fetched: Oct. 19, 2025, 9:27 a.m., Published: -	Vulnerabilities: authorization vulnerability, privilege escalation, authorization flaw

Affected products

External IDs

db:

NVD

ids:

CVE-2025-6950, CVE-2025-6892, CVE-2025-6949, CVE-2025-6893, CVE-2025-6894

Rootkit on Cisco Devices: Operation Zero Disk Discovered Related entries in the VARIoT vulnerabilities database: VAR-201703-0892 Trust: 5.5 Fetched: Oct. 17, 2025, 9:51 a.m., Published: Oct. 15, 2025, 7:53 p.m.	Vulnerabilities: code execution, buffer overflow

Affected products

External IDs

vendor:	trend	model:	security
vendor:	cisco	model:	ios xe software
vendor:	cisco	model:	series
vendor:	cisco	model:	cisco ios
vendor:	cisco	model:	cisco ios xe
vendor:	cisco	model:	ios xe
vendor:	trend micro	model:	security

db:

NVD

ids:

CVE-2017-3881, CVE-2025-20352

Cisco IOS XE Software HTTP API Command Injection Vulnerability Trust: 4.75 Fetched: Oct. 17, 2025, 9:51 a.m., Published: Sept. 24, 2025, 4:06 p.m.	Vulnerabilities: command injection

Affected products

External IDs

vendor:	cisco	model:	ios xe software
vendor:	cisco	model:	ios software
vendor:	cisco	model:	router
vendor:	cisco	model:	nx-os software
vendor:	cisco	model:	ios xr
vendor:	cisco	model:	cisco ios
vendor:	cisco	model:	ios xr software
vendor:	cisco	model:	cisco ios xe
vendor:	cisco	model:	nx-os
vendor:	cisco	model:	ios xe

Tenable discovers RCE vulnerabilities in SimpleHelp \| Tenable® Trust: 4.75 Fetched: Oct. 17, 2025, 9:49 a.m., Published: Oct. 16, 2025, 2 p.m.	Vulnerabilities: code execution, request forgery, cross-site request forgery

Affected products

External IDs

vendor:

trend

model:

security

db:

NVD

ids:

CVE-2025-36727, CVE-2025-36728

GHSA-6g2v-66ch-6xmh - XSS - SecAlerts Trust: 5.75 Fetched: Oct. 17, 2025, 9:48 a.m., Published: -	Vulnerabilities: cross-site scripting, code execution, script execution

Affected products

External IDs

vendor:

jquery

model:

jquery

db:

NVD

ids:

CVE-2025-62412

Apple Font Parser Vulnerability 2025 Puts Devices at Risk Trust: 5.5 Fetched: Oct. 17, 2025, 9:47 a.m., Published: Oct. 17, 2025, midnight	Vulnerabilities: memory corruption

Affected products

External IDs

vendor:	apple	model:	macos
vendor:	apple	model:	installer
vendor:	trend	model:	security
vendor:	trend	model:	antivirus

db:

NVD

ids:

CVE-2025-43400

The ‘Pixnapping’ Attack Can Steal Your 2FA Codes \| Lifehacker Trust: 3.5 Fetched: Oct. 17, 2025, 9:46 a.m., Published: Oct. 14, 2025, 7 p.m.	Vulnerabilities: -

Affected products

External IDs

vendor:	google	model:	pixel
vendor:	google	model:	android
vendor:	samsung	model:	galaxy
vendor:	samsung	model:	samsung

db:

NVD

ids:

CVE-2025-48561

Cisco IOS and IOS XE Software Vulnerabilities Let Attackers Execute Remote Code Trust: 3.75 Fetched: Oct. 17, 2025, 9:45 a.m., Published: Oct. 17, 2025, 2:26 a.m.	Vulnerabilities: code execution

Affected products

External IDs

vendor:	cisco	model:	ios xe software
vendor:	cisco	model:	nx-os software
vendor:	cisco	model:	access points
vendor:	cisco	model:	ios xr
vendor:	cisco	model:	cisco ios
vendor:	cisco	model:	ios xr software
vendor:	cisco	model:	routers
vendor:	cisco	model:	nx-os
vendor:	cisco	model:	ios xe

VARIoT news about IoT security