Sign-up

VARIoT news about IoT security

TP-Link routers hit again as fresh vulnerabilities exposed deep firmware cracks, leading to full remote device control | TechRadar

Related entries in the VARIoT vulnerabilities database: VAR-202406-0858

Trust: 4.75

Fetched: Oct. 26, 2025, 9:37 a.m., Published: Oct. 23, 2025, 10:05 p.m.
 Vulnerabilities: command injection, code execution
Affected productsExternal IDs
vendor: tp-link model: routers
db: NVD ids: CVE-2025-7850, CVE-2024-21827, CVE-2025-7851

CVE-2025-26781 : Denial of Service Vulnerability in Samsung Mobile Processors and Wearable Devices

Trust: 4.75

Fetched: Oct. 24, 2025, 9:29 a.m., Published: Oct. 20, 2025, midnight
 Vulnerabilities: denial of service
Affected productsExternal IDs
vendor: samsung model: samsung
vendor: samsung model: samsung mobile
vendor: samsung model: exynos
vendor: samsung model: mobile
db: NVD ids: CVE-2025-26781

Zyxel security advisory for post-authentication command injection and missing authorization vulnerabilities in ZLD firewalls | Zyxel Networks

Trust: 4.75

Fetched: Oct. 24, 2025, 9:29 a.m., Published: Oct. 7, 2025, midnight
 Vulnerabilities: authorization vulnerability, command injection
Affected productsExternal IDs
db: NVD ids: CVE-2025-9133, CVE-2025-8078

H-ISAC TLP White Vulnerability Bulletin: TP-Link Security Advisory Released (CVE-2025-6542 and CVE-2025-6541) | AHA

Trust: 3.25

Fetched: Oct. 24, 2025, 9:29 a.m., Published: Oct. 22, 2025, 3:01 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
db: NVD ids: CVE-2025-6541, CVE-2025-6542

Warning: Multiple Vulnerabilities in SAUTER modulo Devices, Patch Immediately! | CCB Safeonweb

Trust: 5.75

Fetched: Oct. 24, 2025, 9:29 a.m., Published: Oct. 5, 2025, midnight
 Vulnerabilities: command injection, improper validation, path traversal
Affected productsExternal IDs
vendor: sauter model: case suite
db: NVD ids: CVE-2025-41722, CVE-2025-41720, CVE-2025-41723, CVE-2025-41724, CVE-2025-41721, CVE-2025-41719

US Government tells agencies to patch Cisco firewalls immediately, or face attack | TechRadar

Trust: 4.75

Fetched: Oct. 24, 2025, 9:27 a.m., Published: Sept. 26, 2025, 1:23 p.m.
 Vulnerabilities: privilege escalation, code execution
Affected productsExternal IDs
vendor: cisco model: firepower
db: NVD ids: CVE-2025-20333, CVE-2025-20362

CVE-2022-38691: BootROM Certificate Validation Vulnerability - Ameeba Exploit Tracker

Trust: 4.25

Fetched: Oct. 24, 2025, 9:27 a.m., Published: Nov. 30, 0001, midnight
 Vulnerabilities: certificate validation vulnerability
Affected productsExternal IDs
db: NVD ids: CVE-2022-38691

RondoDox botnet fires 'exploit shotgun' at edge devices • The Register

Trust: 4.5

Fetched: Oct. 24, 2025, 9:22 a.m., Published: -
 Vulnerabilities: os command injection, command injection
Affected productsExternal IDs
vendor: brickcom model: brickcom
vendor: trend micro model: security
vendor: cisco model: linksys
vendor: cisco model: routers
vendor: trend model: security
vendor: four-faith model: four-faith
db: NVD ids: CVE-2024-3721, CVE-2024-12856

25,000 IPs Scanned Cisco ASA Devices - New Vulnerability Potentially Incoming

Trust: 3.0

Fetched: Oct. 24, 2025, 9:21 a.m., Published: Oct. 7, 2025, 8:25 p.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: cisco model: cisco adaptive security appliance
vendor: cisco model: adaptive security appliance

Update Microsoft Windows Server 23H2: addresses a remote code execution (RCE) vulnerability that was identified in WSUS

Trust: 4.25

Fetched: Oct. 24, 2025, 9:21 a.m., Published: Feb. 24, 2048, midnight
 Vulnerabilities: code execution
Affected productsExternal IDs
db: NVD ids: CVE-2025-59287

ZYXEL Authorization Bypass Vulnerability Let Attackers View and Download

Trust: 3.75

Fetched: Oct. 24, 2025, 9:21 a.m., Published: Oct. 23, 2025, midnight
 Vulnerabilities: -
Affected productsExternal IDs
vendor: snort model: snort
db: NVD ids: CVE-2025-9133

How Weak Passwords Expose You to Serious Security Risks

Trust: 4.5

Fetched: Oct. 24, 2025, 9:20 a.m., Published: Jan. 17, 2024, 2 p.m.
 Vulnerabilities: brute force attack, weak password
Affected productsExternal IDs
vendor: essential model: phone

Cybersecurity Threat Advisory: Critical WatchGuard firewall vulnerability | ITSC

Trust: 5.5

Fetched: Oct. 24, 2025, 9:19 a.m., Published: Oct. 22, 2025, 4:46 p.m.
 Vulnerabilities: code execution, buffer overflow
Affected productsExternal IDs
vendor: watchguard model: fireware
vendor: watchguard model: firebox
vendor: barracuda model: barracuda
vendor: barracuda model: running
db: NVD ids: CVE-2025-9242

Critical Sauter AG Flaw (CVE-2025-41723, CVSS 9.8) Allows Unauthenticated File Upload via SOAP Interface

Trust: 4.75

Fetched: Oct. 24, 2025, 9:18 a.m., Published: Oct. 22, 2025, 12:30 a.m.
 Vulnerabilities: traversal attack, code execution, default credentials...
Affected productsExternal IDs
vendor: sauter model: case suite
db: NVD ids: CVE-2025-41722, CVE-2025-41720, CVE-2025-41723, CVE-2025-41724, CVE-2025-41721, CVE-2025-41719

Update Microsoft Defender Vulnerability Management: use CVE exceptions to exclude specific Common Vulnerabilities and Exposures

Trust: 3.0

Fetched: Oct. 24, 2025, 9:18 a.m., Published: Oct. 6, 2025, midnight
 Vulnerabilities: privilege escalation, code execution
Affected productsExternal IDs

Microsoft rolled out new firmware updates (October 21, 2025) for Surface Laptop SE

Trust: 3.0

Fetched: Oct. 24, 2025, 9:17 a.m., Published: Oct. 21, 2025, midnight
 Vulnerabilities: denial of service, information disclosure
Affected productsExternal IDs

Critical Vulnerability Discovered in WatchGuard Fireware: Urgent Action Required for VPN Security - Businesstechweekly.com

Trust: 3.0

Fetched: Oct. 24, 2025, 9:16 a.m., Published: Oct. 23, 2025, 5:01 a.m.
 Vulnerabilities: -
Affected productsExternal IDs
vendor: watchguard model: fireware
vendor: watchguard model: watchguard fireware

ASKI Energy ALS-Mini-S8 and ALS-Mini-S4 | CISA

Trust: 5.25

Fetched: Oct. 24, 2025, 9:16 a.m., Published: Oct. 1, 2025, midnight
 Vulnerabilities: authentication vulnerability
Affected productsExternal IDs
db: NVD ids: CVE-2025-9574

Update Microsoft Windows Server 2022: KB5070884: address a remote code execution (RCE) vulnerability that was identified in WSUS

Trust: 4.25

Fetched: Oct. 24, 2025, 9:15 a.m., Published: Oct. 24, 2022, midnight
 Vulnerabilities: code execution
Affected productsExternal IDs
db: NVD ids: CVE-2025-59287

Zero-click Dolby audio bug lets attackers run code on Android and Windows devices | Malwarebytes

Trust: 5.5

Fetched: Oct. 24, 2025, 9:15 a.m., Published: Oct. 22, 2025, noon
 Vulnerabilities: code execution, buffer overflow
Affected productsExternal IDs
vendor: google model: pixel
vendor: google model: android
vendor: samsung model: mobile devices
vendor: samsung model: mobile
vendor: samsung model: samsung
db: NVD ids: CVE-2025-54957