VARIoT IoT vulnerabilities database

On Ricoh SP C250DN 1.06 devices, a debug port can be used. Ricoh SP C250DN The device contains an input validation vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. RICOH SP C250DN is a printer from Ricoh Japan. There is a security vulnerability in RICOH SP C250DN version 1.06. Attackers can use this vulnerability to retrieve sensitive information

Ricoh SP C250DN 1.06 devices allow CSRF. Ricoh SP C250DN The device contains a cross-site request forgery vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. RICOH SP C250DN is a printer from Ricoh Japan. The vulnerability stems from a web application's insufficient verification that the request came from a trusted user. An attacker could use this vulnerability to send an unexpected request to the server through an affected client

Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2). Ricoh SP C250DN The device contains an authentication vulnerability.Information may be obtained. RICOH SP C250DN is a printer from Ricoh Japan. An information disclosure vulnerability exists in RICOH SP C250DN version 1.06. The vulnerability stems from configuration errors during the operation of the network system or product. An unauthorized attacker could use the vulnerability to obtain sensitive information about the affected component

Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2). Ricoh SP C250DN The device contains an authentication vulnerability.Information may be obtained. RICOH SP C250DN is a printer from Ricoh Japan. An information disclosure vulnerability exists in RICOH SP C250DN version 1.06. The vulnerability stems from configuration errors during the operation of the network system or product. An unauthorized attacker could use the vulnerability to obtain sensitive information about the affected component

A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1

ZXR10 1800-2S is a router product of ZTE Corporation of China. ZTE ZXR10 1800-2S has file reading vulnerability. An attacker could use this vulnerability to read arbitrary files.

KGW3101 gateway products can realize the conversion between Modbus TCP and Modbus RTU / ASCII protocols. KGW3101 has a command execution vulnerability. An attacker could use this vulnerability to cause the KGW3101 device to execute arbitrary commands

ZXR10 1800-2S is a router product of ZTE Corporation of China. ZTE ZXR10 1800-2S has file reading vulnerability. An attacker could use this vulnerability to read arbitrary files.

ZXR10 1800-2S is a router product of ZTE Corporation of China. ZTE ZXR10 1800-2S has file reading vulnerability. An attacker could use this vulnerability to read arbitrary files.

ZXR10 1800-2S is a router product of ZTE Corporation of China. ZXR10 1800-2S has a denial of service vulnerability. An attacker can use this vulnerability to cause a denial of service response by constructing a special data message.

ZXR10 1800-2S is a router product of ZTE Corporation of China. ZTE ZXR10 1800-2S has file reading vulnerability. An attacker could use this vulnerability to read arbitrary files.

ZXR10 1800-2S is a router product of ZTE Corporation of China. ZTE ZXR10 1800-2S has file reading vulnerability. An attacker could use this vulnerability to read arbitrary files.

Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11. plural Broadcom The base cable modem contains a classic buffer overflow vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Sagemcom F@st 5260 and Sagemcom F@st 3890 are routers. Technicolor TC7230 STEB is a wireless router

languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parameter. Rasilient PixelStor 5000 Contains an input validation vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Rasilient PixelStor 5000 is a RAID disk array. A remote code execution vulnerability exists in languageOptions.php in Rasilient PixelStor 5000 K: 4.0.1580-20150629 (KDI version)

An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of application configuration information. Remote attackers can use this vulnerability to submit special requests to obtain sensitive information

Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etc_ro/web/adm/system_command.asp shell feature. Billion Smart Energy Router SG600R2 is a router device

A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows remote attackers to inject arbitrary web script or HTML via the ContentFrame parameter. Rasilient PixelStor 5000 Contains a cross-site scripting vulnerability.The information may be obtained and the information may be falsified. Rasilient PixelStor 5000 is a low cost, high bandwidth and high availability RAID disk array. Option / optionsAll.php in Rasilient PixelStor 5000 K: 4.0.1580-20150629 (KDI version) has a cross-site scripting vulnerability

Digi AnywhereUSB 14 allows XSS via a link for the Digi Page. Digi AnywhereUSB 14 Contains a cross-site scripting vulnerability.The information may be obtained and the information may be falsified. The AnywhereUSB product is a network-capable USB hub that allows USB devices to connect to any local area network. Digi Anywhere USB 14 has an XSS injection vulnerability, which allows an attacker to perform an XSS attack on the corresponding program to obtain other information in a system or file

XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etc_ro/web/internet/dhcpcliinfo.asp. Billion Smart Energy Router SG600R2 Contains a cross-site scripting vulnerability.The information may be obtained and the information may be falsified. When malicious data is viewed, they can obtain sensitive information or hijack user sessions

In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in Juniper Networks Junos OS allows a specific SNMP request to trigger an infinite loop causing a high CPU usage Denial of Service (DoS) condition. This issue affects both SNMP over IPv4 and IPv6. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D90; 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D238, 15.1X53-D592; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R3-S1; 17.2 versions prior to 17.2R3-S2; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R3; 18.2X75 versions prior to 18.2X75-D50; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R2. Juniper Networks Junos OS Contains a resource exhaustion vulnerability.Denial of service (DoS) May be in a state. Juniper Networks Junos OS is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware equipment. The operating system provides a secure programming interface and Junos SDK. An attacker could exploit this vulnerability to cause a denial of service (infinite loop and heavy CPU consumption). The following products and versions are affected: Juniper Networks Junos OS Release 12.3X48, Release 15.1, Release 15.1X49, Release 15.1X53, Release 16.1, Release 16.2, Release 17.1, Release 17.2, Release 17.3, Release 17.4, Release 18.1, Release 18.2, Version 18.2X75, Version 18.3, Version 18.4, Version 19.1, Version 19.2