VARIoT IoT vulnerabilities database

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. An API is used to execute a command manifest file during upgrade does not correctly prevent directory traversal and so can be used to execute manifest files in arbitrary locations on the node. The API does not require user authentication and is accessible over the management network, resulting in the potential for unauthenticated remote execution of manifest files. For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061901&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience. plural HPE SimpliVity The product contains a path traversal vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. There are security holes in many HPE products

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. Two now deprecated APIs run as root, accept a file name path, and can be used to create or delete arbitrary files on the nodes. These APIs do not require user authentication and are accessible over the management network, resulting in remote availability and integrity vulnerabilities For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061675&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience. plural HPE SimpliVity The product contains an unspecified vulnerability.Information may be altered. There are security holes in many HPE products

Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the SOAP storeConfigToFS endpoint of the WebAnalysisWSService/WebAnalysisWS path in the service. When parsing the arg0 parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM and to create a denial-of-service condition. The vulnerability stems from insufficient input validation provided by the user to the API. A remotely authenticated attacker with administrative rights can exploit this vulnerability by sending a specially crafted request to the API to read, write to any file, or execute any file in the system with full administrative rights. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the fm/fmrest/dbadmin/saveLicenseFileToServer path in the service. When parsing the fileNames parameter, the process does not properly validate a user-supplied path prior to using it in file operations. The vulnerability stems from insufficient input validation provided by the user to the API. A remotely authenticated attacker with administrative rights can exploit this vulnerability by sending a specially crafted request to the API to read, write to any file, or execute any file in the system with full administrative rights. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the processing of requests to the upload endpoint. When parsing the file parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions. A path traversal vulnerability exists in the Application Framework functionality in Cisco DCNM releases prior to 11.3(1) due to insufficient validation of user input sent to Application Framework endpoints

Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Data Center Network Manager (DCNM) Contains a vulnerability in the use of hard-coded credentials.Information may be obtained. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of web requests. The system contains a hard-coded administrator username and password that can be used to bypass authentication for some functions. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. A hardcoded encryption key allows any user who accesses the encrypted password for the database to obtain the plaintext password. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions. The web management interface in versions prior to Cisco DCNM 11.3(1) has a trust management issue vulnerability. A remote attacker could exploit this vulnerability by using static credentials to bypass authentication

A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker would need administrative privileges on the DCNM application. The vulnerability exists because the SOAP API improperly handles XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by inserting malicious XML content in an API request. A successful exploit could allow the attacker to read arbitrary files from the affected device. Note: The severity of this vulnerability is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of requests to the getInventoryIslList SOAP endpoint of DashboardWSService/DashboardWS. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker could leverage this vulnerability to disclose stored credentials, leading to further compromise. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the processing of requests to the DbInventoryWSService/DbInventoryWS service. When parsing the first parameter of the getEndPortConnectionsForStorageEnclosure endpoint, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. The vulnerability stems from insufficient input validation provided by the user to the API. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system (OS). For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the processing of requests to the fabrics endpoint. When parsing the name parameter in the createLanFabric method, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. The vulnerability stems from insufficient input validation provided by the user to the API. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Data Center Network Manager (DCNM) Contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The issue results from trusting input that has been encrypted with a hard-coded and discoverable cryptographic key. An attacker can leverage this vulnerability to add new global admins to the system. The vulnerability stems from a static encryption key shared by all installations. A remote unauthenticated attacker could exploit this vulnerability by using a static key to create a valid session token to manage permissions and perform arbitrary operations through the REST API. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system (OS). For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the processing of requests to the importTS endpoint of the SanWSService/SanWS service. When parsing the certFile parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. The vulnerability stems from insufficient input validation provided by the user to the API. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Data Center Network Manager (DCNM) Contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Authentication is not required to exploit this vulnerability.The specific flaw exists within the validation of SSO tokens of SOAP packets. The issue results from the use of a hard-coded key to validate the message digest. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. The vulnerability stems from a static encryption key shared by all installations. A remote unauthenticated attacker could exploit this vulnerability by using a static key to create a valid session token to manage permissions and perform arbitrary operations through the REST API. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions. A trust management issue vulnerability existed in Cisco DCNM prior to 11.3(1) due to the presence of static credentials in the software

C2000-B2-SIE0101-BB1 is an industrial-grade serial device networking server. A denial of service vulnerability exists in the C2000-B2-SFE0101-BB1 serial server. An attacker can use this vulnerability to cause the server to deny service.

D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php. D-Link DIR-859 is a wireless AC1750 high power Wi-Fi Gigabit router. Attackers can use this vulnerability to obtain information through AUTHORIZED_GROUP = 1% 0a

Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability. The system does not properly check the status of certain module during certain operations, an attacker should trick the user into installing a malicious application, successful exploit could cause reboot of the smartphone. plural Huawei The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Huawei Honor V10 and other products are products of Huawei of China. Huawei Honor V10 is a smartphone product. Huawei Honor 10 is a smartphone product. Mate 10 Pro is a smartphone

HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability. An attacker could send specific command in the local area network (LAN) to exploit this vulnerability. Successful exploitation may cause information leak. Huawei P30 Smartphones contain information disclosure vulnerabilities.Information may be obtained. The Huawei P30 is a smartphone from China's Huawei

A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unauthorized access to the JBoss Enterprise Application Platform (JBoss EAP) on an affected device. The vulnerability is due to an incorrect configuration of the authentication settings on the JBoss EAP. An attacker could exploit this vulnerability by authenticating with a specific low-privilege account. A successful exploit could allow the attacker to gain unauthorized access to the JBoss EAP, which should be limited to internal system accounts. Cisco Data Center Network Manager (DCNM) Contains an incorrect authentication vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200 have an improper credentials management vulnerability. The software does not properly manage certain credentials. Successful exploit could cause information disclosure or damage, and impact the confidentiality or integrity. USG9500 Contains a vulnerability related to insufficient protection of credentials.Information may be obtained and information may be altered

KTP600 is a set of touch screen based on Windows platform developed by Siemens, which is used to quickly construct and generate the configuration software system of the host computer monitoring system. An information disclosure vulnerability exists in the Siemens KTP600PN touch screen. Attackers can use this vulnerability to obtain sensitive information

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network. D-Link DIR-859 Wi-Fi The router has OS A command injection vulnerability exists.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. D-Link DIR-859 is a wireless router from Taiwan D-Link Corporation. A remote command execution vulnerability exists in DLINK's DIR-859 series routers. Attackers can use this vulnerability to execute arbitrary commands on target devices with root privileges