VARIoT IoT vulnerabilities database

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID is LVE-SMP-180006. SystemUI application intents is one of the system applications. The vulnerability stems from the program's failure to perform correct access control. A remote attacker can use this vulnerability to bypass security restrictions by sending a specially crafted request and gain access to MLT applications

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004. GNSS application is one of the global satellite navigation applications. The vulnerability stems from the program's failure to perform correct access control. Remote attackers can use this vulnerability to gain access to GNSS applications

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005. SystemUI application intents is one of the system applications. Remote attackers can use this vulnerability to bypass security restrictions and gain access to SystemUI applications

An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0. Eltex ESP-200 The firmware contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The EltexESP-200 is a wireless router product

An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP-200 firmware version 1.2.0. Eltex ESP-200 Firmware contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Eltex ESP-200 is a wireless router product. A security vulnerability exists in the Eltex ESP-200 using firmware version 1.2.0. A remote attacker could exploit this vulnerability to gain elevated privileges

Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a DoS vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Due to improper handling of the malformed messages, an attacker may sent crafted packets to the affected device to exploit these vulnerabilities. Successful exploit the vulnerability could lead to device deny of service. plural Huawei Firewall The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Huawei USG2205BSR etc. IPSEC IKEv1 is one of the Internet key exchange components. The vulnerability is caused by the program not correctly processing malformed packets. The following products and versions are affected: Huawei USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00

Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a DoS vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Due to improper handling of the malformed messages, an attacker may sent crafted packets to the affected device to exploit these vulnerabilities. Successful exploit the vulnerability could lead to device deny of service. plural Huawei Firewall The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Huawei USG2205BSR etc. IPSEC IKEv1 is one of the Internet key exchange components. The vulnerability is caused by the program not processing malformed packets correctly. The following products and versions are affected: Huawei USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00

An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmware version 1.2.0. Eltex ESP-200 The firmware contains a vulnerability related to input validation.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The EltexESP-200 is a wireless router product. An elevation of privilege exists in EltexESP-200 with firmware version 1.2.0. An attacker could exploit this vulnerability to activate a high-privileged user

Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbacher RSA padding oracle. Cause a Bleichenbacher oracle attack. Successful exploit this vulnerability can impact IPSec tunnel security. plural Huawei Firewall The product contains cryptographic vulnerabilities.Information may be obtained. Huawei USG2205BSR etc. IPSEC IKEv1 is one of the Internet key exchange components. The following products and versions are affected: Huawei USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00

An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0. Eltex ESP-200 firmware Contains vulnerabilities related to security features.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The EltexESP-200 is a wireless router product. A security hole exists in the EltexESP-200 using firmware version 1.2.0

An authenticated attacker with low privileges can extract password hash information for all users in Eltex ESP-200 firmware version 1.2.0. Eltex ESP-200 Firmware contains an information disclosure vulnerability.Information may be obtained. The EltexESP-200 is a wireless router product

Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118. Kraftway24F2XGRouter is a wireless router product from Kraftway, Russia. A security vulnerability exists in Kraftway24F2XGRouter using firmware version 3.5.30.1118, which was caused by the program using SSLv2 and SSLv3. A remote attacker can exploit this vulnerability to perform a man-in-the-middle attack and decrypt the passed data

Denial of service via crafting malicious link and sending it to a privileged user can cause Denial of Service in Kraftway 24F2XG Router firmware version 3.5.30.1118. Kraftway 24F2XG Router The firmware contains a link interpretation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Kraftway24F2XGRouter is a wireless router product from Kraftway, Russia

A Buffer Overflow exploited through web interface by remote attacker can cause denial of service in Kraftway 24F2XG Router firmware 3.5.30.1118. Kraftway 24F2XG Router The firmware contains a buffer error vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Kraftway24F2XGRouter is a wireless router product from Kraftway, Russia. A buffer overflow vulnerability exists in Kraftway24F2XGRouter using firmware version 3.5.30.1118

An attacker with low privileges can cause denial of service in Kraftway 24F2XG Router firmware version 3.5.30.1118. Kraftway 24F2XG Router There are unspecified vulnerabilities in the firmware.Service operation interruption (DoS) There is a possibility of being put into a state. Kraftway24F2XGRouter is a wireless router product from Kraftway, Russia

ASUSDSLN10 is a wired and wireless modem router. In the ASUSDSLN10C1 modem firmware version 1.1.2.2_17, the post data has the login_authorization parameter, which is used to authorize access to the management panel. The data of this parameter is not completely random. The attacker can use the old data or other device data access management panel.

A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution in Kraftway 24F2XG Router firmware 3.5.30.1118. Kraftway 24F2XG Router The firmware contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Kraftway24F2XGRouter is a wireless router product from Kraftway, Russia. A buffer overflow vulnerability exists in Kraftway24F2XGRouter using firmware version 3.5.30.1118

Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the router. Kraftway 24F2XG Router Firmware vulnerabilities related to authorization, authority, and access controlInformation is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Kraftway 24F2XG Router is a wireless router product of Russian Kraftway company. The vulnerability is caused by the program using default credentials. A remote attacker could exploit this vulnerability to gain administrative privileges

The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. A malicious local unprivileged user may gain knowledge of sensitive information, manipulate certain data, or assume super-user privileges on the local client host. F5 BIG-IP APM client Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. F5 BIG-IP APM client is the client software in a set of access and security solutions of F5 Corporation of the United States. The software primarily provides unified access to business-critical applications and networks. svpn is one of the VPN components. policyserver is one of the policy servers

Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy. By clicking on the link, unprivileged users can open additional dialog boxes and get access to the local machine windows explorer which can be used to get administrator privilege. Windows Logon Integration is vulnerable when the APM client is installed by an administrator on a user machine. Users accessing the local machine can get administrator privileges. F5 BIG-IP APM client Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. F5 BIG-IP APM client is the client software in a set of access and security solutions of F5 Corporation of the United States. The software primarily provides unified access to business-critical applications and networks