VARIoT IoT vulnerabilities database

Various Lexmark products have Incorrect Access Control (issue 2 of 2). Lexmark CS31x and others are all printers from Lexmark. This vulnerability stems from network systems or products not properly restricting access to resources from unauthorized roles. The following products and versions are affected: CS31x with firmware LW71.VYL.P229 and earlier; CS41x with firmware LW71.VY2.P229 and earlier; CX310 with firmware LW71.GM2.P229 and earlier; MS310 with .P229 and earlier firmware; MS312 with LW71.GM2.P229 and earlier firmware; MS317 with LW71.GM2.P229 and earlier firmware; MS410 with LW71.PRL.P229 and earlier firmware; M1140 with firmware version .PRL.P229 and earlier; MS315 with firmware version LW71.TL2.P229 and earlier; MS415 with firmware version LW71.TL2.P229 and earlier; MS417 with firmware version LW71.TL2.P229 and earlier; MX31x with firmware LW71.SB2.P229 and earlier; XM1135 with firmware LW71.SB2.P229 and earlier; MS51x with firmware LW71.PR2.P229 and earlier; firmware with LW71.PR2.P229 and earlier MS610dn; MS617 using LW71.PR2.P229 and earlier firmware; M1145 using LW71.PR2.P229 and earlier firmware; M3150dn using LW71.PR2.P229 and earlier firmware; using LW71.DN2.P229 and earlier MS71x with firmware LW71.DN2.P229 and earlier; M5163dn with firmware LW71.DN2.P229 and earlier; MS810 with firmware LW71.DN2.P229 and earlier; MS811 with firmware LW71.DN2.P229 and earlier; MS812 with previous version firmware; MS817 with LW71.DN2.P229 and previous version firmware; MS818 with LW71.DN2.P229 and previous version firmware

Various Lexmark products have a Buffer Overflow (issue 3 of 3). plural Lexmark The product contains a buffer error vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Lexmark CS31x and others are all printers from Lexmark. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. The following products and versions are affected: Lexmark CS31x with firmware LW71.VYL.P230 and earlier; CS41x with firmware LW71.VY2.P230 and earlier; CS51x with firmware LW71.VY4.P230 and earlier; GM2.P230 and previous versions of CX310, etc

Various Lexmark products have Incorrect Access Control. Lexmark CS31x and others are all printers from Lexmark. An attacker could exploit this vulnerability by conducting a brute force attack to obtain local account credentials. The following products and versions are affected: CS31x with firmware LW71.VYL.P229 and earlier; CS41x with firmware LW71.VY2.P229 and earlier; CS51x with firmware LW71.VY4.P229 and earlier; .CX310 with firmware of P229 and earlier versions, etc

A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). SmartHome The application contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ASUS SmartHome is a smart home control management application from ASUS in Taiwan

Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser. Dell EMC Unity, etc. are the products of the United States Dell (Dell). EMC UnityVSA is a set of virtual EMC Unity storage environments. EMC VNXe3200 is a 2U dual-controller unified storage product. The vulnerability stems from the lack of proper validation of client data by web applications. An attacker could use this vulnerability to execute client code

A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) Access Control List (ACL) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to perform SNMP polling of an affected device, even if it is configured to deny SNMP traffic. The vulnerability is due to an incorrect length check when the configured ACL name is the maximum length, which is 32 ASCII characters. An attacker could exploit this vulnerability by performing SNMP polling of an affected device. A successful exploit could allow the attacker to perform SNMP polling that should have been denied. The attacker has no control of the configuration of the SNMP ACL name. Cisco NX-OS The software contains vulnerabilities related to authorization, permissions, and access control.Information may be tampered with. Cisco NX-OS Software is a data center-level operating system software used by a set of switches of Cisco. The following products and versions are affected: Cisco Nexus 3000 Series Switches; Nexus 3500 Platform Switches; Nexus 3600 Platform Switches; Nexus 9000 Series Switches (standalone NX-OS mode); Nexus 9500 R-Series Switching Platform

The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP mode allows a malicious user to obtain plaintext authentication credentials for a remote FTP server from the ASG/ProxySG's web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2. ASG and ProxySG Contains an information disclosure vulnerability.Information may be obtained. Both Symantec Advanced Secure Gateway and Symantec ProxySG are security gateway devices of Symantec Corporation of the United States. This vulnerability stems from configuration errors in network systems or products during operation. An unauthorized attacker could exploit the vulnerability to obtain sensitive information of the affected components

The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2. ASG and ProxySG Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Both Symantec Advanced Secure Gateway and Symantec ProxySG are security gateway devices of Symantec Corporation of the United States. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

Various Lexmark products have CSRF. plural Lexmark The product contains a cross-site request forgery vulnerability.Information may be tampered with. Lexmark CS31x and others are all printers from Lexmark. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could exploit this vulnerability to send unexpected requests to the server through an affected client. The following products and versions are affected: Lexmark CS31x; CS41x; CX310; MS310; MS312; MS317; MS410; M1140; MS315; MS415; MS417; MS811; MS812; MS817; MS818

A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication. AndroVideo Advan VD-1 is a security camera from Taiwan's AndroVideo. AndroVideo Advan VD-1 has a trust management issue vulnerability. AndroVideo Advan VD-1 is a security camera produced by AndroVideo Company in Taiwan, China. to attack affected components

The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time. CVSS 3.0 Base score 7.4 (Availability impacts). CVSS vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). ASUS HG100 The firmware contains a vulnerability related to resource exhaustion.Service operation interruption (DoS) There is a possibility of being put into a state. ASUS SmartHome Gateway HG100 is a smart home central control gateway device from Taiwan ASUS (ASUS). A security vulnerability exists in the web api server on port 8080 in the ASUS SmartHome Gateway HG100 using firmware version 1.05.12 and earlier. An attacker could exploit the vulnerability to cause a denial of service

A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). HG100 firmware Contains an access control vulnerability.Information may be obtained and information may be altered. The ASUS SmartHome Gateway HG100 has a security vulnerability, allowing remote attackers to use the vulnerability to submit special requests, bypass security restrictions, and perform unauthorized requests, such as controlling devices. ASUS SmartHome Gateway HG100 is a smart home central control gateway device from ASUS, Taiwan

In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. Knowage Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases. Knowage Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.). Edimax BR-6208AC V1 The device contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Edimax BR-6208AC is a wireless concurrent dual-band router. Edimax BR-6208AC V1 has a hidden channel vulnerability across routers. An attacker could exploit this vulnerability to make ARP requests to any computer on the network. Edimax Technology BR-6208AC is a wireless router manufactured by Edimax Technology, Taiwan, China

D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.). D-link DIR-825AC G1 The device contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-Link DIR-825 is an AC 1200 Wi-Fi dual-band Gigabit (LAN / WAN) router. A security vulnerability exists in D-link DIR-825AC G1. D-Link D-link DIR-825AC G1 is a wireless router made by Taiwan D-Link Company

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.). The TP-Link Archer C3200 and Archer C2 are both wireless routers from China's TP-Link. The vulnerability stems from the fact that the program does not fully isolate the host network and guest network on the same device

Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field. Edimax BR-6208AC V1 The device contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Edimax BR-6208AC is a wireless concurrent dual-band router. Edimax BR-6208AC V1 has a hidden channel vulnerability across routers. Edimax Technology BR-6208AC is a wireless router manufactured by Edimax Technology, Taiwan, China

Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender. Edimax BR-6208AC V1 device Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Edimax BR-6208AC is a wireless concurrent dual-band router. Edimax BR-6208AC V1 has a hidden channel vulnerability across routers. Edimax Technology BR-6208AC is a wireless router manufactured by Edimax Technology, Taiwan, China. An attacker could exploit this vulnerability by sending specially crafted IGMP Membership Query packets to transmit data between two isolated network segments on the same device

D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field. D-link DIR-825AC G1 The device contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-Link DIR-825 is an AC 1200 Wi-Fi dual-band Gigabit (LAN / WAN) router. D-link DIR-825AC G1 has a hidden tunnel vulnerability across routers. D-Link DIR-825AC G1 is a wireless router made by Taiwan D-Link Company