VARIoT IoT vulnerabilities database

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information. Philips ISCV The application contains a session deadline vulnerability.Information may be obtained and information may be altered. Philips IntelliSpace Cardiovascular (ISCV) is a comprehensive heart image and information management system. The Philips IntelliSpace Cardiovascular System has an unauthorized access vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. IntelliSpace Cardiovascular version 2.3.0 and prior versions are vulnerable. The system provides viewing of echographic images and a single point of access for physicians

A vulnerability has been identified in TeleControl Server Basic < V3.1. An authenticated attacker with a low-privileged account to the TeleControl Server Basic's port 8000/tcp could escalate his privileges and perform administrative operations. TeleControl Server Basic Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Siemens TeleControl Server Basic is a remote control system for Siemens equipment from Siemens AG. An attacker can leverage these issues to obtain sensitive information, bypass security restrictions and gain elevated privileges. Failed exploit attempts may result in a denial of service condition

A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with network access to the TeleControl Server Basic's port 8000/tcp could bypass the authentication mechanism and read limited information. Siemens TeleControl Server Basic is a remote control system for Siemens equipment from Siemens AG. Failed exploit attempts may result in a denial of service condition. This may aid in further attacks

SOC8000 IP-PBX is a new generation carrier-grade unified communications system. There is a vulnerability in command execution in SOC8000 IP-PBX. Allows an attacker to construct specific code, execute commands remotely, write to a webshell, and gain server permissions.

An Improper Input Validation issue was discovered in Nari PCS-9611 relay. An improper input validation vulnerability has been identified that affects a service within the software that may allow a remote attacker to arbitrarily read/access system resources and affect the availability of the system. Nari PCS-9611 The relay contains a vulnerability related to input validation.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NariPCS-9611relay is a line protection measurement and control device of China National Electric Corporation Nari. An input validation vulnerability exists in NariPCS-9611relay. A remote attacker can exploit this vulnerability to read/access system resources at will

Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page. Netis WF2419 The device contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. NetisWF2419 is a wireless router product from China Tiandan Network (NETIS). A cross-site scripting vulnerability exists in the NetisWF24192.2.36123 release that stems from a program that does not adequately filter user-submitted data. A remote attacker can use the \342\200\230Description\342\200\231 parameter of the BandwidthControlRuleSettings page to exploit the vulnerability to execute web scripts or HTML in the context of an affected website. There is a cross-site scripting vulnerability in Netis WF2419 version 2.2.36123

An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1). Multiple SQL injection vulnerabilities are present in the legacy .ASP pages, which could allow attackers to execute arbitrary SQL commands via unspecified vectors. Ipswitch WhatsUp Gold Is SQL An injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Ipswitch WhatsUp Gold is a set of unified infrastructure and application monitoring software from Ipswitch in the United States. The software supports the performance management of networks, servers, virtual environments and applications

A vulnerability has been identified in Desigo PXC00-E.D V4.10 (All versions < V4.10.111), Desigo PXC00-E.D V5.00 (All versions < V5.0.171), Desigo PXC00-E.D V5.10 (All versions < V5.10.69), Desigo PXC00-E.D V6.00 (All versions < V6.0.204), Desigo PXC00/64/128-U V4.10 (All versions < V4.10.111 only with web module), Desigo PXC00/64/128-U V5.00 (All versions < V5.0.171 only with web module), Desigo PXC00/64/128-U V5.10 (All versions < V5.10.69 only with web module), Desigo PXC00/64/128-U V6.00 (All versions < V6.0.204 only with web module), Desigo PXC001-E.D V4.10 (All versions < V4.10.111), Desigo PXC001-E.D V5.00 (All versions < V5.0.171), Desigo PXC001-E.D V5.10 (All versions < V5.10.69), Desigo PXC001-E.D V6.00 (All versions < V6.0.204), Desigo PXC100-E.D V4.10 (All versions < V4.10.111), Desigo PXC100-E.D V5.00 (All versions < V5.0.171), Desigo PXC100-E.D V5.10 (All versions < V5.10.69), Desigo PXC100-E.D V6.00 (All versions < V6.0.204), Desigo PXC12-E.D V4.10 (All versions < V4.10.111), Desigo PXC12-E.D V5.00 (All versions < V5.0.171), Desigo PXC12-E.D V5.10 (All versions < V5.10.69), Desigo PXC12-E.D V6.00 (All versions < V6.0.204), Desigo PXC200-E.D V4.10 (All versions < V4.10.111), Desigo PXC200-E.D V5.00 (All versions < V5.0.171), Desigo PXC200-E.D V5.10 (All versions < V5.10.69), Desigo PXC200-E.D V6.00 (All versions < V6.0.204), Desigo PXC22-E.D V4.10 (All versions < V4.10.111), Desigo PXC22-E.D V5.00 (All versions < V5.0.171), Desigo PXC22-E.D V5.10 (All versions < V5.10.69), Desigo PXC22-E.D V6.00 (All versions < V6.0.204), Desigo PXC22.1-E.D V4.10 (All versions < V4.10.111), Desigo PXC22.1-E.D V5.00 (All versions < V5.0.171), Desigo PXC22.1-E.D V5.10 (All versions < V5.10.69), Desigo PXC22.1-E.D V6.00 (All versions < V6.0.204), Desigo PXC36.1-E.D V4.10 (All versions < V4.10.111), Desigo PXC36.1-E.D V5.00 (All versions < V5.0.171), Desigo PXC36.1-E.D V5.10 (All versions < V5.10.69), Desigo PXC36.1-E.D V6.00 (All versions < V6.0.204), Desigo PXC50-E.D V4.10 (All versions < V4.10.111), Desigo PXC50-E.D V5.00 (All versions < V5.0.171), Desigo PXC50-E.D V5.10 (All versions < V5.10.69), Desigo PXC50-E.D V6.00 (All versions < V6.0.204), Desigo PXM20-E V4.10 (All versions < V4.10.111), Desigo PXM20-E V5.00 (All versions < V5.0.171), Desigo PXM20-E V5.10 (All versions < V5.10.69), Desigo PXM20-E V6.00 (All versions < V6.0.204). A remote attacker with network access to the device could potentially upload a new firmware image to the devices without prior authentication. plural Desigo Automation Controller and Desigo Operator Unit Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The SIEMENS building automation system Desigo PX programmable automation station offers a flexible solution for alarm signals, time-based logging and trends, which can be modified or expanded at any time. A file upload vulnerability exists in the Siemens DESIGO PX firmware, which is used by unauthenticated remote attackers to upload malicious firmware. Multiple Siemens Desigo Automation Controllers are prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks. The following products and versions are vulnerable: Versions prior to Desigo Automation Controllers Compact PXC12/22/36-E.D 6.00.204 Versions prior to Desigo Automation Controllers Modular PXC00/50/100/200-E.D 6.00.204 Versions prior to Desigo Automation Controllers PXC00/64/128-U with Web module 6.00.204 Versions prior to Desigo Automation Controllers for Integration PXC001-E.D 6.00.204, and Versions prior to Desigo Operator Unit PXM20-E 6.00.204

Huawei Mate 9 Pro smartphones with software LON-AL00BC00B139D; LON-AL00BC00B229 have an integer overflow vulnerability. The camera driver does not validate the external input parameters and causes an integer overflow, which in the after processing results in a buffer overflow. An attacker tricks the user to install a crafted application, successful exploit could cause malicious code execution. HuaweiMate9Pro is a smartphone from China's Huawei company. Huawei Smart Phones are prone to an integer-overflow vulnerability. Failed exploit attempts will likely cause a denial-of-service condition. The vulnerability is caused by the fact that the program does not check external input parameters

Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page. Netis WF2419 The device contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. NetisWF2419 is a wireless router product from China Tiandan Network (NETIS). A cross-site scripting vulnerability exists in the NetisWF24193.2.41381 release that stems from a program that does not adequately filter user-submitted data. A remote attacker can use the Description field on the MACFiltering page to exploit the vulnerability to execute HTML or script code in the context of an affected website. There is a cross-site scripting vulnerability in Netis WF2419 version 3.2.41381

A Cross-Site Scripting (XSS) vulnerability was found in Routers2 2.24, affecting the 'rtr' GET parameter in a page=graph action to cgi-bin/routers2.pl. Routers2 Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Routers2 is a front-end routing setup tool. A remote attacker could exploit this vulnerability to inject malicious scripts into a client browser

RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request. RAVPower FileHub Contains an information disclosure vulnerability.Information may be obtained. RAVPowerFileHub is a versatile digital device from RAVPower Corporation of the United States. The device also has features such as a card reader, USB storage, and a NAS file server. A security vulnerability exists in the RAVPowerFileHub2.000.056 version

An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1). Remote clients can take advantage of a misconfiguration in the TFTP server that could allow attackers to execute arbitrary commands on the TFTP server via unspecified vectors. Ipswitch WhatsUp Gold Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Ipswitch WhatsUp Gold is a set of unified infrastructure and application monitoring software from Ipswitch in the United States. The software supports the performance management of networks, servers, virtual environments and applications. There is a security vulnerability in Ipswitch WhatsUp Gold 2017 Plus SP1 (17.1.1) and earlier versions, the vulnerability is caused by a misconfiguration of the TFTP server

This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00(AWG.3)D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability is caused by improper access controls that allow access to critical functions without authentication. An attacker can use this vulnerability to reboot affected devices, along with other actions. Was ZDI-CAN-4540. ZyXEL P-870H-51 DSL Router Contains an access control vulnerability. Zero Day Initiative Is vulnerable to this vulnerability ZDI-CAN-4540 Was numbered.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The ZyXELP-870H-51DSLRouter is a wireless router product from ZyXEL Technology. A security vulnerability exists in the exposedCGI endpoint in the ZyXELP-870H-51DSLRouter 1.00 (AWG.3) D5 release, which stems from a failure to properly control access

This vulnerability allows attackers on the local network to create a denial-of-service condition on the Belkin Wemo Link and Smart Plug device, despite factory resets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML parsing in the UPNP service. When parsing changeFriendlyName requests, the process does not properly validate the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to trigger an infinite reboot loop and deny service to users of the device.

A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. WebAccess/SCADA does not properly sanitize its inputs for SQL commands. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the user parameter in chkLogin2.asp. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose sensitive information under the context of the database. Advantech WebAccess is a browser-based human interface HMI software package, as well as monitoring and data acquisition SCADA. Advantech WebAccess/SCADA is a browser-based SCADA software developed by Advantech. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Belkin Wemo Link. Authentication is not required to exploit this vulnerability.The specific flaw exists within the syseventd daemon, which listens on TCP port 52367 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code under the context of root.

A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. An attacker has read access to files within the directory structure of the target device. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the filename parameter of certUpdate.asp. The issue results from the lack of proper validation of user-supplied data, which can allow for the upload of arbitrary files. An attacker can leverage this vulnerability to execute code under the context of the current process. Advantech WebAccess is a browser-based human interface HMI software package, as well as monitoring and data acquisition SCADA. Advantech WebAccess/SCADA has a directory traversal vulnerability. Advantech WebAccess/SCADA is prone to a directory-traversal vulnerability and a SQL-injection vulnerability A remote attacker could exploit these issues to access data, or exploit latent vulnerabilities in the underlying database or use directory-traversal characters ('../') to access arbitrary files that contain sensitive information. Advantech WebAccess/SCADA is a browser-based SCADA software developed by Advantech. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment

HP has identified a potential security vulnerability before IG_11_00_00.10 for DesignJet T790, T795, T1300, T2300, before MRY_04_05_00.5 for DesignJet T920, T930, T1500, T1530, T2500, T2530, before AENEAS_03_04_00.9 for DesignJet T3500, before NEXUS_01_12_00.11 for Latex 310, 330, 360, 370, before NEXUS_03_12_00.15 for Latex 315, 335, 365, 375, before STORM_00_05_01.6 for Latex 560, 570 and Latex 110 that may expose the credentials of the SMTP server configured to receive and process emails generated by the printers. plural HP DesignJet and Latex The product contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. HPDesignJetT790 and other printers are the United States HP (HP) company. There are SMTP credential vulnerabilities in several HP products. An attacker could exploit the vulnerability to obtain a certificate for the SMTP server. HP DesignJet T790, etc. The following products and versions are affected: HP DesignJet T790 prior to IG_11_00_00.10; DesignJet T795 prior to IG_11_00_00.10; DesignJet T1300 prior to IG_11_00_00.10; DesignJet T2300 prior to IG_11_00_00.10; DesignJet T920 prior to MRY_04_05 DesignJet T930 prior to MRY_04_05_00.5; DesignJet T1500 prior to MRY_04_05_00.5; DesignJet T1530 prior to MRY_04_05_00.5; DesignJet T2500 prior to MRY_04_05_00.5; Latex 310 before NEXUS_01_12_00.11; Latex 330 before NEXUS_01_12_00.11; Latex 360 before NEXUS_01_12_00.11; Latex 370 before NEXUS_01_12_00.11 before 305_Latex Versions; Latex 335 prior to NEXUS_03_12_00.15; Latex 365 prior to NEXUS_03_12_00.15; Latex 375 prior to NEXUS_03_12_00.15; Latex 560 prior to STORM_00_05_01.6; Latex 570 prior to STORM_00_05_01.6

On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver before commit f079fa005aae08ee0e1bc32699874ff4f02e11c1, the Linux Kernel i40e/i40evf driver before e7358f54a3954df16d4f87e3cad35063f1c17de5 and the DPDK before commit 3f12b9f23b6499ff66ec8b0de941fb469297e5d0, additionally Multiple vendor NIC firmware is affected. The Linux kernel is the kernel used by the operating system Linux released by the American Linux Foundation. Linux kernel ixgbe driver and i40e/i40evf driver are the network card drivers; DPDK is one of the data plane development kits. Security vulnerabilities exist in several products. An attacker could exploit this vulnerability to control the throughput and latency of other virtual machines