VARIoT IoT vulnerabilities database

A vulnerability was found in Tenda AC8V4 V16.03.34.06. Affected is the function SUB_0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. of AC8 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda AC8 has a buffer overflow vulnerability, which can be exploited by attackers to cause the program to crash or even execute arbitrary code

Tenda O4 V3.0 V1.0.0.10(2936) is vulnerable to Buffer Overflow in the function SafeSetMacFilter of the file /goform/setMacFilterList via the argument remark/type/time. Shenzhen Tenda Technology Co.,Ltd. of O4 Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda O4 is a router product of Tenda. Remote attackers can use this vulnerability to submit special requests, which can cause the application to crash and execute arbitrary code in the context of the application

Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

A vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configured rules and allow emails that should have been denied to flow through an affected device.   This vulnerability is due to improper handling of email that passes through an affected device. An attacker could exploit this vulnerability by sending a crafted email through the affected device. A successful exploit could allow the attacker to bypass email filters on the affected device. Cisco Systems Secure Email Gateway Exists in unspecified vulnerabilities.Information may be tampered with. Remote attackers can bypass the rules and conduct malicious attacks by submitting special emails through the vulnerability

‌Siemens SiPass integrated‌ is a powerful and flexible access control system for organizations of all sizes, from simple offices to large, complex facilities with thousands of doors, gates, barriers, and elevators. A directory traversal vulnerability exists in DotNetZip, a third-party component of Siemens SiPass integrated, which can be exploited by an attacker to execute arbitrary code on the application server if a specially crafted backup set is used to restore it.

A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the destination, netmask, and gateway parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. D-Link Systems, Inc. D-Link DSL-3782 is a wireless router from Taiwan's D-Link company

An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type parameter. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet. D-Link Systems, Inc. (DoS) It may be in a state. D-Link DSL-3782 is a wireless router from D-Link. The vulnerability originates from processing the public_type parameter

An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba_wg and samba_nbn parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet. D-Link Systems, Inc. (DoS) It may be in a state. D-Link DSL-3782 is a wireless router from Taiwan's D-Link company

An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet. D-Link Systems, Inc. (DoS) It may be in a state. D-Link DSL-3782 is a wireless router from Taiwan's D-Link company

A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the sstartip, sendip, dstartip, and dendip parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. D-Link Systems, Inc. D-Link DSL-3782 is a wireless router from Taiwan's D-Link company

A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the destination, netmask and gateway parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. D-Link Systems, Inc. D-Link DSL-3782 is a wireless router from D-Link, a Chinese company

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-11714. Reason: This candidate is a reservation duplicate of CVE-2018-11714. Notes: All CVE users should reference CVE-2018-11714 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. TP-LINK Technologies of wr840n An authentication vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding "?x=1.gif" to the the requested url, it will be recognized as passing the authentication. of netgear DGN2200 An authentication vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. NETGEAR DGN2200 is a wireless router from NETGEAR. NETGEAR DGN2200 has a permission issue vulnerability

Opcenter Intelligence (formerly known as "Manufacturing Intelligence") connects manufacturing data from disparate company sources and aggregates it into cohesive, intelligent, and contextualized information. Siemens Opcenter Intelligence Tableau Server component has multiple vulnerabilities that can be exploited by attackers to affect the confidentiality and integrity of the system.

A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/webproc?getpage=html/index.html&var:menu=24gwlan&var:page=24G_basic. The manipulation of the argument SSID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Systems, Inc. of DIR-816 The firmware contains cross-site scripting and code injection vulnerabilities.Information may be obtained and information may be tampered with. D-Link DIR-816 is a wireless router from D-Link of China. D-Link DIR-816 version 1.01TO has a code injection vulnerability. The vulnerability is caused by the incorrect operation of the parameter SSID, which will lead to a cross-site scripting attack. Attackers can use this vulnerability to execute malicious scripts, steal user cookies, or conduct phishing attacks

A cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be triggered via the manipulation of the SSID argument in the sysinfo.asp file, leading to disclosure of sensitive information. Note: All versions of RT-N10E and RT-N12E are unsupported (End-of-Life, EOL). Consumers can mitigate this vulnerability by disabling the remote access features from WAN. ASUS RT-N12E is a wireless router from ASUS, a Chinese company. Attackers can exploit this vulnerability to execute arbitrary web scripts or HTML by injecting carefully crafted payloads

A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK of x18 The firmware contains a buffer error vulnerability, a stack-based buffer overflow vulnerability, and an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK X18 is a Gigabit router from China's TOTOLINK Electronics. The vulnerability is caused by the parameter String of the file /cgi-bin/cstecgi.cgi failing to correctly verify the length of the input data. Remote attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK of x18 The firmware contains a command injection vulnerability. OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK X18 is a Gigabit router from China's TOTOLINK Electronics. TOTOLINK X18 9.1.0cu.2024_B20220329 version has a command injection vulnerability, which is caused by the parameter enable of the file /cgi-bin/cstecgi.cgi failing to properly filter special characters and commands in the constructed command. Attackers can exploit this vulnerability to cause arbitrary command execution

Xiamen Four-Faith Communication Technology Co., Ltd. is a global leading provider of IoT communication equipment and solutions. There is a logic flaw in the video surveillance management system of Xiamen Four-Faith Communication Technology Co., Ltd., which can be exploited by attackers to obtain sensitive information.

TMS320F28335 is a high-performance TMS320C28x series 32-bit floating-point DSP processor produced by TI. Texas Instruments Incorporated. TMS320F28335 has a logic flaw vulnerability that can be exploited by attackers to cause a denial of service.