VARIoT IoT vulnerabilities database

asterisk allows calls on prohibited networks. asterisk Contains an unauthorized authentication vulnerability.Information may be tampered with

The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a /%2f/ path traversal attack, which can be exploited in order to test for the existence of a file pathname outside of the web root directory. If a file exists but is not part of the product, there is a 404 error. If a file does not exist, there is a 302 redirect to index.html. Compal Broadband CH7465LG Modem contains a path traversal vulnerability.Information may be obtained. The Compal Broadband CH7465LG modem is a modem from Compal, Taiwan

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attacker to gain unauthorised access or disclose encrypted data on the RTU due to the keys not being regenerated on initial installation or with firmware updates. In other words, these devices use private-key values in /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_dsa_key files that are publicly available from the vendor web sites. Mitsubishi Electric ME-RTU Device and INEA ME-RTU A device contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Inea ME-RTU is an intelligent communication gateway product from Inea Company of Slovenia. Mitsubishi Electric smartRTU 2.02 and earlier versions and INEA ME-RTU 3.0 and earlier versions have a trust management issue vulnerability that originates from the device in / etc / ssh / ssh_host_rsa_key, / etc / ssh / ssh_host_ecdsa_key, and / etc / ssh / ssh_host_dsa_key The private key value in can be accessed through the manufacturer's website, and an attacker could use this vulnerability to gain unauthorized access or leak encrypted information

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.). Mitsubishi Electric ME-RTU Device and INEA ME-RTU A device contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Inea ME-RTU is an intelligent communication gateway product from Inea Company of Slovenia. The vulnerability originates from a program with an undocumented account (using hard-coded credentials). An attacker could exploit this vulnerability to Elevated to root

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data. Mitsubishi Electric ME-RTU Device and INEA ME-RTU The device has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Inea ME-RTU is an intelligent communication gateway product from Inea Company of Slovenia

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script (XSS) vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to stored XSS is SerialInitialModemString in the index.php page. Mitsubishi Electric ME-RTU Device and INEA ME-RTU A cross-site scripting vulnerability exists in the device.Information may be obtained and information may be tampered with. Inea ME-RTU is an intelligent communication gateway product from Inea Company of Slovenia. The vulnerability stems from the lack of proper verification of client data by web applications. Attackers can use this vulnerability to execute client code

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulnerability allows an attacker to download the smartRTU's configuration file (which contains data such as usernames, passwords, and other sensitive RTU data). Mitsubishi Electric ME-RTU Device and INEA ME-RTU The device contains a vulnerability related to information leakage.Information may be obtained. Inea ME-RTU is an intelligent communication gateway product of Inea Company in Slovenia. There are security vulnerabilities in Mitsubishi Electric smartRTU 2.02 and earlier versions and INEA ME-RTU 3.0 and earlier versions

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init/settings.xml configuration file on the file system allows an attacker to read sensitive configuration settings such as usernames, passwords, and other sensitive RTU data due to insecure permission assignment. Mitsubishi Electric ME-RTU Device and INEA ME-RTU A device contains a vulnerability regarding improper default permissions.Information may be obtained. Inea ME-RTU is an intelligent communication gateway product of Inea, Slovenia. There are security vulnerabilities in Mitsubishi Electric smartRTU 2.02 and earlier versions and INEA ME-RTU 3.0 and earlier versions. The vulnerabilities stem from the program assigning global readable permissions to the /usr/smartrtu/init/settings.xml file on the file system

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. An unauthenticated user can obtain the exposed password credentials to gain access to the following services: DDNS service, Mobile Network Provider, and OpenVPN service. Mitsubishi Electric ME-RTU Device and INEA ME-RTU The device contains a vulnerability related to information leakage from the cache.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Inea ME-RTU is an intelligent communication gateway product from Inea Company of Slovenia. Mitsubishi Electric smartRTU 2.02 and earlier versions and INEA ME-RTU 3.0 and earlier versions have password plaintext storage vulnerabilities. The vulnerability stems from programs storing passwords in plain text. Access to services

An issue was discovered on TerraMaster FS-210 4.0.19 devices. Normal users can use 1.user.php for privilege elevation. TerraMaster FS-210 The device contains a privilege management vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The TerraMaster FS-210 is a NAS (Network Attached Storage) device from the company of TerraMaster, Shenzhen, China. A privilege escalation vulnerability exists in the TerraMaster FS-210 version 4.0.19, which can be exploited by an attacker to gain privileges with the 1.user.php file

Baidu Tiangong Intelligent Platform is a cloud service platform for the Internet of Things field. It communicates through mainstream IoT protocols (such as MQTT), and can build IoT projects between smart devices and the cloud. An unauthorized access vulnerability exists in Baidu Tiangong's intelligent platform. Attackers can use last-will to receive messages without authorization.

Baidu Tiangong Intelligent Platform is a cloud service platform for the Internet of Things field. It communicates through mainstream IoT protocols (such as MQTT), and can build IoT projects between smart devices and the cloud. An unauthorized access vulnerability exists in Baidu Tiangong's intelligent platform. Attackers can use the vulnerability to send unauthorized messages.

Baidu Tiangong Intelligent Platform is a cloud service platform for the Internet of Things field. It communicates through mainstream IoT protocols (such as MQTT), and can build IoT projects between smart devices and the cloud. There is a denial-of-service vulnerability in Baidu Tiangong's intelligent platform. Attackers can use their own identity credentials to construct others' ClientIDs to conduct denial-of-service attacks.

Baidu Tiangong Intelligent Platform is a cloud service platform for the Internet of Things field. It communicates through mainstream IoT protocols (such as MQTT), and can build IoT projects between smart devices and the cloud. An unauthorized access vulnerability exists in Baidu Tiangong's intelligent platform, and an attacker can use ClientID to receive messages in excess of its authority.

Baidu Tiangong Intelligent Platform is a cloud service platform for the Internet of Things field. It communicates through mainstream IoT protocols (such as MQTT), and can build IoT projects between smart devices and the cloud. An unauthorized access vulnerability exists in the Retained Message of Baidu Tiangong Intelligent Platform.

Alibaba Cloud IoT platform is a cloud service platform for the IoT field. It communicates through mainstream IoT protocols (such as MQTT) and can build IoT projects between smart devices and the cloud. There is an unauthorized access vulnerability in the Alibaba Cloud IoT platform, and an attacker can use the vulnerability to always receive messages on the topic of the subscription.

MITSUBISHI PLC is a programmable controller product of Japan's Mitsubishi Electric (Mitsubishi Electric) company. MITSUBISHI PLC has a denial of service vulnerability, which can be exploited by attackers to cause a denial of service

SIEMENS SIMATIC S7-400 is a modular universal controller of Siemens (Siemens) for the manufacturing industry. SIEMENS SIMATIC S7-400 has a denial of service vulnerability. An attacker can use this vulnerability to cause a denial of service

D-Link DIR-865L has Information Disclosure. D-Link DIR-865L is a wireless router from Taiwan D-Link Corporation. The vulnerability stems from configuration errors during the operation of the network system or product. An unauthorized attacker could use the vulnerability to obtain sensitive information about the affected component

Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations. Milesight IP security cameras Contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. An attacker could use this vulnerability to access these accounts