VARIoT IoT vulnerabilities database

A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Cisco Cloud Services Platform 2100 Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCvk20726

A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are used during install. The vulnerability is due to a hard-coded password that, in some cases, is not replaced with a unique password. A successful exploit could allow the attacker to access the administrative web interface with administrator-level privileges. Cisco Prime Collaboration Provisioning is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device. Versions prior to Cisco Prime Collaboration Provisioning 12.1 are vulnerable. This issue is being tracked by Cisco Bug ID CSCvd86564. The software provides IP communications services functionality for IP telephony, voice mail, and unified communications environments. A trust management vulnerability exists in the installation functionality in Cisco PCP releases prior to 12.1

A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software fails to release spinlocks when a device is running low on system memory, if the software is configured to apply FTP inspection and an access control rule to transit traffic, and the access control rule is associated with an FTP file policy. An attacker could exploit this vulnerability by sending a high rate of transit traffic through an affected device to cause a low-memory condition on the device. A successful exploit could allow the attacker to cause a software panic on the affected device, which could cause the device to reload and result in a temporary DoS condition. This issue is being tracked by Cisco Bug ID CSCvh77456. Cisco 3000 Series Industrial Security Appliances and so on are different series of security equipment of Cisco (Cisco). The following products are affected: Cisco 3000 Series Industrial Security Appliances (ISAs); ASA 5500-X Series Next-Generation Firewalls; Firepower 2100 Series Security Appliances; Firepower 4100 Series Security Appliances;

A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted, remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system, causing application functions to operate abnormally and leading to a DoS condition. Cisco Unity Connection Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco Unity Connection is prone to a denial of service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. This issue is being tracked by Cisco Bug IDs CSCvj79033. Cisco Unity Connection (UC) is a set of voice message platform of Cisco (Cisco). The platform can use voice commands to make calls or listen to messages "hands-free". Bulk Administration Tool (BAT) is one of the batch management tools

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system. Cisco Webex Network Recording Player and Webex Player Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. These issues are being tracked by Cisco Bug IDs CSCvj83752, CSCvj83767, CSCvj83771, CSCvj83793, CSCvj83797, CSCvj83803, CSCvj83818, CSCvj83824, CSCvj83831, CSCvj87929, CSCvj87934, CSCvj93870, CSCvj93877, CSCvk31089, CSCvk33049, CSCvk52510, CSCvk52518, CSCvk52521, CSCvk59945, CSCvk59949, CSCvk59950, CSCvk60158, CSCvk60163, CSCvm51315, CSCvm51318, CSCvm51361, CSCvm51371, CSCvm51373, CSCvm51374, CSCvm51382, CSCvm51386, CSCvm51391, CSCvm51393, CSCvm51396, CSCvm51398, CSCvm51412, CSCvm51413, CSCvm54531, and CSCvm54538

A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain BGP update messages. An attacker could exploit this vulnerability by sending BGP update messages that include a specific, malformed attribute to be processed by an affected system. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP traffic only from explicitly defined peers. To exploit this vulnerability, the malicious BGP update message would need to come from a configured, valid BGP peer, or would need to be injected by the attacker into the victim's BGP network on an existing, valid TCP connection to a BGP peer. Cisco IOS XR The software contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco IOSXR Software is a fully modular, distributed network operating system from Cisco's IOS software family, including IOST, IOSS, and IOSXR. Cisco IOS XR Software is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause the denial-of-service conditions. This issue is being tracked by Cisco Bug ID CSCvj58445

A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in a way that allowed it to be extracted. This applies to consumer notebooks launched in early 2014. HP 240 G1 Notebook PC, etc. are all notebook computer products of Hewlett-Packard (HP) in the United States. Attackers can exploit this vulnerability to extract BIOS passwords. The following products are affected: HP 240 G1 Notebook PC; 245 G1 Notebook PC; 1000-1300~1000-1399 Notebook PC; Compaq CQ45-900~CQ45-999 Notebook PC; 250 G1 Notebook PC; 255 G1 Notebook PC; ENVY (TouchSmart ) 15-j000~j099 Notebook PC; ENVY (TouchSmart) 15-j100~j199 Notebook PC; Pavilion (TouchSmart) 15-n000~199 Notebook PC; 246 Notebook PC; 455 Notebook PC; ENVY (TouchSmart) 17-j100~j199 Notebook PC; ENVY (TouchSmart) 17-j100 ~ j199 Leap Motion SE Notebook PC; Split 13-g200~299 x2 PC; ENVY (TouchSmart) 100~15-j199 Notebook PC; Pavilion (TouchSmart) 14-n000~199 Notebook PC ; ENVY (TouchSmart) 14-k100~14-k199 Sleekbook; ENVY TouchSmart 14-k100~14-k199 Ultrabook; Specter x2 13-SMB Pro; Specter 13-h200~299 x2 PC; Pavilion 15-n200~299 (TouchSmart) Notebook PC; Pavilion 15-n300~399

A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this vulnerability by sending a GET request to a vulnerable device. A successful exploit could allow the attacker to view sensitive information. Cisco Prime Infrastructure Contains an information disclosure vulnerability.Information may be obtained. This issue is being tracked by Cisco bug ID CSCvg93148

A vulnerability in the web-based management interface of Cisco Small Business 300 Series Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerability exists because the affected management interface performs insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or allow the attacker to access sensitive, browser-based information. CiscoSmallBusiness300SeriesManagedSwitches is a switch device from Cisco. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue being tracked by Cisco Bug ID CSCvj58239

A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions. This vulnerability is known as Cross Site Request Forgery, and could potentially be exploited remotely to allow elevation of privilege. certain HP printers and MFPs Contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. HP MFPs are a series of MFP printers produced by Hewlett-Packard (HP) in the United States. A remote attacker could exploit this vulnerability to elevate privileges

A vulnerability in the web-based management interface of Cisco Unified IP Phone 7900 Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCvj73657

On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change. D-Link DIR-823G The device contains a vulnerability related to the password management function.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDIR-823G is a wireless router from D-Link. An attacker could use this vulnerability to modify the administrator password

On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot. D-Link DIR-823G The device contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. The D-Link DIR-823G is a router device. An attacker could exploit the vulnerability to cause a denial of service (restart)

A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this vulnerability by sending a GET request to a vulnerable device. A successful exploit could allow the attacker to view sensitive information. Cisco Prime Infrastructure Contains an information disclosure vulnerability.Information may be obtained. This issue is being tracked by Cisco bug ID CSCvg93152

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system. Cisco Webex Network Recording Player and Webex Player Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. These issues are being tracked by Cisco Bug IDs CSCvj83752, CSCvj83767, CSCvj83771, CSCvj83793, CSCvj83797, CSCvj83803, CSCvj83818, CSCvj83824, CSCvj83831, CSCvj87929, CSCvj87934, CSCvj93870, CSCvj93877, CSCvk31089, CSCvk33049, CSCvk52510, CSCvk52518, CSCvk52521, CSCvk59945, CSCvk59949, CSCvk59950, CSCvk60158, CSCvk60163, CSCvm51315, CSCvm51318, CSCvm51361, CSCvm51371, CSCvm51373, CSCvm51374, CSCvm51382, CSCvm51386, CSCvm51391, CSCvm51393, CSCvm51396, CSCvm51398, CSCvm51412, CSCvm51413, CSCvm54531, and CSCvm54538

A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites. plural Cisco The product contains an open redirect vulnerability.Information may be obtained and information may be altered. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible. Cisco Emergency Responder, etc. are all products of Cisco (Cisco). Cisco Emergency Responder is an emergency call software in an IP communication system. Finesse is a next-generation customer collaboration service solution

A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient restrictions on the size or total amount of resources allowed via the web interface. An attacker who has valid credentials for the application could exploit this vulnerability by sending a crafted or malformed HTTP request to the web interface. A successful exploit could allow the attacker to cause oversubscription of system resources or cause a component to become unresponsive, resulting in a DoS condition. Multiple Cisco Products are prone to a denial-of-service vulnerability. This issue is being tracked by Cisco Bug IDs CSCvj95431 and CSCvk10284. UCS Director Software is a converged infrastructure management solution

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly include the access level of the web interface user. An attacker who has valid application credentials could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional reconnaissance attacks. Multiple Cisco Products are prone to an information-disclosure vulnerability. This issue is being tracked by Cisco Bug IDs CSCvj95420 and CSCvk10260. UCS Director Software is a converged infrastructure management solution

A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Cisco UCS Director Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCvj95427. Cisco UCS Director (formerly known as Cisco Cloupia) is a set of converged infrastructure management solutions from Cisco. The solution supports users to manage computing power, network services, storage, and virtual machines from a single management console to deploy and release IT services more quickly and at low cost

A vulnerability in the web-based management interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious, customized link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device via a web browser and with the privileges of the user. Cisco Industrial Network Director is an industrial automation management system from Cisco. The system is automated through the visualization of industrial Ethernet infrastructure. This issue is being tracked by Cisco bug ID CSCvk00412