VARIoT IoT vulnerabilities database

A Heap-Based Buffer Overflow issue was discovered in Advantech WebOP. A maliciously crafted project file may be able to trigger a heap-based buffer overflow, which may crash the process and allow an attacker to execute arbitrary code. Advantech WebOP Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebOP Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of a pm3 project file. Advantech WebOP is an operator panel product. Failed exploit attempts will likely cause a denial-of-service condition. Advantech WebOP is an integrated human-machine interface development tool developed by Advantech. The product has functions such as data transmission, menu editing and text editing

PTW-WMS1 firmware version 2.000.012 allows remote attackers to bypass access restrictions to obtain or delete data on the disk via unspecified vectors. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 provided by Princeton Ltd. is a Wi-Fi storage. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 contains multiple vulnerabilities listed below. * Improper Access Restriction (CWE-284) - CVE-2017-10900 * Buffer Overflow (CWE-119) - CVE-2017-10901 * OS Command Injection (CWE-78) - CVE-2017-10902 * Improper Authentication (CWE-287) - CVE-2017-10903 Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. - CVE-2017-10900 * Receiving a specially crafted packet from a remote attacker may result in a denial-of-service (DoS) condition. - CVE-2017-10901 * A remote attacker may log in the device and execute an arbitrary OS command. - CVE-2017-10902 * A remote attacker may log in the device with the root privilege and conduct arbitrary operations. - CVE-2017-10903. An access restriction vulnerability exists in PrincetonPTW-WMS1 using firmware version 2.000.012

IBM WebSphere MQ 9.0.2 could allow an authenticated user to potentially cause a denial of service by saving an incorrect channel status inquiry. IBM X-Force ID: 124354. IBM WebSphere MQ There is a service disruption (DoS) There are vulnerabilities that are put into a state. IBM MQ is prone to a denial-of-service vulnerability. Remote attackers can exploit this issue to crash the service, denying service to legitimate users

Input validation issue in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to cause the device to become unresponsive via unspecified vectors. BBR-4HG and BBR-4MG provided by BUFFALO INC. are wireless LAN routers. BBR-4HG and BBR-4MG contain multiple vulnerabilities listed below. * Cross-site Scripting (CWE-79) - CVE-2017-10896 * Improper Input Validation (CWE-20) - CVE-2017-10897 Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.The possible impact of each vulnerability is as follows: * An arbitrary script may be executed on the user's web browser If a logged-in user accesses a specially crafted page - CVE-2017-10896 * The device may become unresponsive if an improper input value is set in the administrative page - CVE-2017-10897. Buffalo BBR-4HG and BBR-4MG are both broadband router products of the Buffalo Group in Japan. An attacker could exploit the vulnerability to cause a denial of service (the device could not respond)

Cross-site scripting vulnerability in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to inject arbitrary web script or HTML via unspecified vectors. BBR-4HG and BBR-4MG provided by BUFFALO INC. are wireless LAN routers. BBR-4HG and BBR-4MG contain multiple vulnerabilities listed below. * Cross-site Scripting (CWE-79) - CVE-2017-10896 * Improper Input Validation (CWE-20) - CVE-2017-10897 Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.The possible impact of each vulnerability is as follows: * An arbitrary script may be executed on the user's web browser If a logged-in user accesses a specially crafted page - CVE-2017-10896 * The device may become unresponsive if an improper input value is set in the administrative page - CVE-2017-10897. Buffalo BBR-4HG and BBR-4MG are both broadband router products of the Buffalo Group in Japan

A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacker who can extract the static credentials from an existing installation of Cisco ESC could generate an admin session token that allows access to all instances of the ESC web UI. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76627. An attacker can exploit this issue to bypass the security mechanism and gain unauthorized access. This may lead to further attacks

A vulnerability in the AutoIT service of Cisco Ultra Services Framework Staging Server could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The vulnerability is due to improper shell invocations. An attacker could exploit this vulnerability by crafting CLI command inputs to execute Linux shell commands as the root user. This vulnerability affects all releases of Cisco Ultra Services Framework Staging Server prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76673. This may aid in further attacks. AutoIT service is one of those services. The vulnerability comes from the fact that the program does not invoke the shell correctly

Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device with root privileges and conduct arbitrary operations via unspecified vectors. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 provided by Princeton Ltd. is a Wi-Fi storage. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 contains multiple vulnerabilities listed below. * Improper Access Restriction (CWE-284) - CVE-2017-10900 * Buffer Overflow (CWE-119) - CVE-2017-10901 * OS Command Injection (CWE-78) - CVE-2017-10902 * Improper Authentication (CWE-287) - CVE-2017-10903 Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.* A remote attacker may access the shared disk connected to the device, and then obtain or delete information in the disk. - CVE-2017-10900 * Receiving a specially crafted packet from a remote attacker may result in a denial-of-service (DoS) condition. - CVE-2017-10901 * A remote attacker may log in the device and execute an arbitrary OS command. - CVE-2017-10903. A security vulnerability exists in PrincetonPTW-WMS1 using firmware version 2.000.012

PTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 provided by Princeton Ltd. is a Wi-Fi storage. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 contains multiple vulnerabilities listed below. * Improper Access Restriction (CWE-284) - CVE-2017-10900 * Buffer Overflow (CWE-119) - CVE-2017-10901 * OS Command Injection (CWE-78) - CVE-2017-10902 * Improper Authentication (CWE-287) - CVE-2017-10903 Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.* A remote attacker may access the shared disk connected to the device, and then obtain or delete information in the disk. - CVE-2017-10900 * Receiving a specially crafted packet from a remote attacker may result in a denial-of-service (DoS) condition. - CVE-2017-10902 * A remote attacker may log in the device with the root privilege and conduct arbitrary operations. - CVE-2017-10903

Buffer overflow in PTW-WMS1 firmware version 2.000.012 allows remote attackers to conduct denial-of-service attacks via unspecified vectors. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 provided by Princeton Ltd. is a Wi-Fi storage. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 contains multiple vulnerabilities listed below. * Improper Access Restriction (CWE-284) - CVE-2017-10900 * Buffer Overflow (CWE-119) - CVE-2017-10901 * OS Command Injection (CWE-78) - CVE-2017-10902 * Improper Authentication (CWE-287) - CVE-2017-10903 Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.* A remote attacker may access the shared disk connected to the device, and then obtain or delete information in the disk. - CVE-2017-10900 * Receiving a specially crafted packet from a remote attacker may result in a denial-of-service (DoS) condition. - CVE-2017-10901 * A remote attacker may log in the device and execute an arbitrary OS command. - CVE-2017-10902 * A remote attacker may log in the device with the root privilege and conduct arbitrary operations. - CVE-2017-10903

A vulnerability in the CLI of the Cisco Prime Network Gateway could allow an authenticated, local attacker to retrieve system process information, which could lead to the disclosure of confidential information. More Information: CSCvd59341. Known Affected Releases: 4.2(1.0)P1. Cisco PrimeNetwork is an integrated component of Cisco PrimeforIPNGNsuite and is a stand-alone product. Allow attackers to obtain sensitive information. This issue is being tracked by Cisco Bug ID CSCvd59341. CLI is one of those command line interfaces

A vulnerability in the Server Message Block (SMB) protocol of Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device due to a process restarting unexpectedly and creating Core Dump files. More Information: CSCvc63035. Known Affected Releases: 6.2(3a). Known Fixed Releases: 6.3(0.167) 6.2(3c)5 6.2(3.22). Vendors have confirmed this vulnerability Bug ID CSCvc63035 It is released as.Remote attacker could disrupt service operation (DoS) There is a possibility of being put into a state. Cisco Wide Area Application Services is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause an affected device to reload, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCvc63035. This software is mainly used in the link environment with small bandwidth and large delay

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary code at the root privilege level on an affected system, because of Incorrect Permissions. More Information: CSCvb99389. Known Affected Releases: 6.2.1.BASE. Known Fixed Releases: 6.3.1.15i.BASE 6.2.3.1i.BASE 6.2.2.15i.BASE 6.1.4.10i.BASE. Cisco IOS is the interconnected network operating system used on most Cisco system routers and network switches. A local attacker may exploit this issue to gain elevated root privileges on the affected system. This issue is being tracked by Cisco Bug ID CSCvb99389

A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve completed reports from an affected system, aka Information Disclosure. This vulnerability affects the following products if they are running an affected release of Cisco Wide Area Application Services (WAAS) Software and are configured to use the Central Manager function: Cisco Virtual Wide Area Application Services (vWAAS), Cisco Wide Area Application Services (WAAS) Appliances, Cisco Wide Area Application Services (WAAS) Modules. Only Cisco WAAS products that are configured with the Central Manager role are affected by this vulnerability. More Information: CSCvd87574. Known Affected Releases: 4.4(7) 6.2(1) 6.2(3). Known Fixed Releases: 6.3(0.228) 6.3(0.226) 6.2(3d)8 5.5(7b)17. Vendors have confirmed this vulnerability Bug ID CSCvd87574 It is released as.Information may be obtained. Successful exploits will allow attackers to obtain sensitive information. This may result in further attacks. This issue is tracked by Cisco Bug ID CSCvd87574. This software is mainly used in the link environment with small bandwidth and large delay. A remote attacker could exploit this vulnerability to retrieve completed reports from an affected system

A vulnerability in Multicast Source Discovery Protocol (MSDP) ingress packet processing for Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the MSDP session to be unexpectedly reset, causing a short denial of service (DoS) condition. The MSDP session will restart within a few seconds. More Information: CSCvd94828. Known Affected Releases: 4.3.2.MCAST 6.0.2.BASE. Known Fixed Releases: 6.3.1.19i.MCAST 6.2.3.1i.MCAST 6.2.2.17i.MCAST 6.1.4.12i.MCAST. Cisco IOS XR The software contains a buffer error vulnerability. Vendors have confirmed this vulnerability Bug ID CSCvd94828 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco IOS is the interconnected network operating system used on most Cisco system routers and network switches. A denial of service vulnerability exists in Cisco IOSXR, which can cause a denial of service (process overload) by sending a constructed SourceDiscoveryProtocol (MSDP) packet. An attacker can exploit this issue to restart the affected process, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCvd94828. The vulnerability is caused by the program not correctly handling errors in MSDP packets

A vulnerability in the installation procedure for Cisco Prime Network Software could allow an authenticated, local attacker to elevate their privileges to root privileges. More Information: CSCvd47343. Known Affected Releases: 4.2(2.1)PP1 4.2(3.0)PP6 4.3(0.0)PP4 4.3(1.0)PP2. Known Fixed Releases: 4.3(2). Vendors have confirmed this vulnerability Bug ID CSCvd47343 It is released as.Authenticated by local attackers root May be promoted to. Cisco PrimeNetwork is an integrated component of Cisco PrimeforIPNGNsuite and is a stand-alone product. This issue is being tracked by Cisco Bug ID CSCvd47343. The installation procedure is one of the installation configuration procedures. The vulnerability stems from the fact that the program does not have the correct installation binary file and does not have the correct permission to configure the binary file

A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated, local attacker to execute arbitrary code on a targeted system. More Information: CSCvc91092. Known Affected Releases: 6.2.0 6.2.1. Cisco FireSIGHTManagementCenter centrally manages the network security and operational features of CiscoASAwithFirePOWERServices and Cisco FirePOWER appliances. Cisco FireSIGHT System Software is prone to a local code-execution vulnerability. This issue is being tracked by Cisco Bug ID CSCvc91092

A vulnerability in the CLI command-parsing code of the Cisco StarOS operating system for Cisco ASR 5000 Series 11.0 through 21.0, 5500 Series, and 5700 Series devices and Cisco Virtualized Packet Core (VPC) Software could allow an authenticated, local attacker to break from the StarOS CLI of an affected system and execute arbitrary shell commands as a Linux root user on the system, aka Command Injection. The vulnerability exists because the affected operating system does not sufficiently sanitize commands before inserting them into Linux shell commands. An attacker could exploit this vulnerability by submitting a crafted CLI command for execution in a Linux shell command as a root user. Cisco Bug IDs: CSCvc69329, CSCvc72930. Vendors have confirmed this vulnerability Bug ID CSCvc69329 and CSCvc72930 It is released as.Of an affected system by an authenticated local attacker. The Cisco ASR5000 Series is a carrier-grade platform for deploying high-demand 3G networks and migrating to long-term evolution. StarOS is a set of Linux operating systems for it. Cisco StarOS is prone to a local command-injection vulnerability because it fails to properly sanitize user-supplied input. Successfully exploiting this issue may allow an attacker to execute arbitrary commands with root privileges. Cisco ASR 5500 Series and so on are the 5500 and other series router equipment of Cisco (Cisco)

A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The vulnerability is due to the absence of validation checks for the input that is used to create symbolic links. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76654

A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device. The vulnerability is due to an insecure default configuration of the Apache ZooKeeper service used by the affected software. An attacker could exploit this vulnerability by accessing the affected device through the orchestrator network. An exploit could allow the attacker to gain access to ZooKeeper data nodes (znodes) and influence the behavior of the system's high-availability feature. This vulnerability affects all releases of Cisco Ultra Services Framework UAS prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvd29395. This may aid in further attacks. Ultra Automation Service is one of the automation services