VARIoT IoT vulnerabilities database

Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite, RSLogix Micro Developer, RSLogix 500 Starter Edition, RSLogix 500 Standard Edition, and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of a RSS (project) file. The issue lies in the failure to properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the process. are all configuration software for automation products in Rockwell Automation. A buffer overflow vulnerability exists in several Rockwell Automation products. Failed exploit attempts will result in denial-of-service conditions

Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify application command. Provided by Yokogawa Electric Corporation STARDOM A vulnerability exists in the controller that allows arbitrary commands to be executed. Provided by Yokogawa Electric Corporation STARDOM For small and medium-sized factories PLC Instrumentation system. STARDOM The controller is not authenticated when connecting from the logic designer (CWE-306) there is. for that reason, STARDOM An arbitrary command may be executed by a third party who can access the controller. CWE-306: Missing Authentication for Critical Function https://cwe.mitre.org/data/definitions/306.htmlSTARDOM By a third party with access to the controller IEC The application may be stopped, the value may be rewritten, or the application may be changed. YokogawaSTARDOMFCN/FCJcontroller is a controller for network-based control systems. Yokogawa STARDOM is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass authentication mechanism and execute arbitrary commands. The following versions are vulnerable: Yokogawa STARDOM FCJ versions from R1.01 to R4.01 are vulnerable. Yokogawa STARDOM FCN versions from R1.01 to R4.01 are vulnerable. The vulnerability is caused by the program not requiring authentication for Logic Designer connection

Cisco IOS XR 6.0 and 6.0.1 on NCS 6000 devices allows remote attackers to cause a denial of service (OSPFv3 process reload) via crafted OSPFv3 packets, aka Bug ID CSCuz66289. The Cisco IOSXRonNCS6000 is a set of operating systems running on 6000 series routers from Cisco. A denial of service vulnerability exists in Cisco IOSXR 6.0 and 6.0.1 on the Cisco NCS6000 appliance. Cisco IOS XR is prone to a remote denial-of-service vulnerability. This issue is being tracked by Cisco Bug ID CSCuz66289. Cisco IOS XR for Cisco NCS600 (64-bit) is vulnerable

UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root access via crafted CLI input, aka Bug ID CSCuz91263. Cisco Unified Computing System is prone to a local privilege-escalation because it fails to sanitize user-supplied input. A local attacker can exploit this issue to execute arbitrary commands with root level privileges. This issue is being tracked by Cisco Bug ID CSCuz91263. Cisco Unified Computing System (UCS) is a unified computing system of Cisco (Cisco). The system integrates network, computing and virtualization resources into one platform by extensively adopting virtualization technology. UCS Manager is one of the embedded device management software. UCS 6200 Fabric Interconnects is one of the interconnection devices

The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of service via a crafted packet, aka Bug IDs CSCuy82904, CSCuy82909, and CSCuy82912. Vendors have confirmed this vulnerability Bug ID CSCuy82904 , CSCuy82909 ,and CSCuy82912 It is released as.Denial of service operation via a packet crafted by a third party (DoS) There is a possibility of being put into a state. Both Cisco IOS and IOSXE are operating systems developed by Cisco for its network devices. DatainMotion (DMo) application is one of the dynamic data update tools. A security vulnerability exists in the Cisco IOS 15.6(1)T release and the DMo application in IOSXE. An attacker can exploit this issue to cause a denial-of-service condition. This issue is being tracked by Cisco Bug IDs CSCuy82904, CSCuy82909 and CSCuy82912

Cross-site scripting (XSS) vulnerability in the web framework in Cisco IOx Local Manager in IOS 15.5(2)T and IOS XE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy19854. Both Cisco IOS and IOSXE are operating systems developed by Cisco for its network devices. CiscoIOxLocalManager is one of the local management components. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCuy19854

Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368. Cisco Fog Director for IOx is an automated management platform based on IOx (an end-to-end application support system that provides application hosting capabilities) for centralized management of multiple applications running on the edge of the network. The platform controls application settings and lifecycles, and supports access and monitoring of large-scale IoT deployments. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCuz89368

Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130. This issue is being tracked by Cisco bug ID CSCuy83130. Cisco WebEx Meetings Server (CWMS) is a set of multi-functional conference solutions including audio, video and Web conference in Cisco's WebEx conference solution. A security vulnerability exists in CWMS version 2.6

Cisco Carrier Routing System (CRS) 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers to cause a denial of service (line-card reload) via crafted IPv6-over-MPLS packets, aka Bug ID CSCva32494. Vendors have confirmed this vulnerability Bug ID CSCva32494 It is released as.Skillfully crafted by a third party IPv6-over-MPLS Service disruption via packets ( Reload line card ) There is a possibility of being put into a state. Cisco CarrierRoutingSystem (CRS) is a carrier-class routing system from Cisco. A remote attacker could exploit the vulnerability by sending a specially crafted IPv6-over-MPLS packet to cause a denial of service (line-card overload). This issue is being tracked by Cisco Bug ID CSCva32494

Cisco AsyncOS through 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously, aka Bug ID CSCuz27219. Cisco Web Security Appliance is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCuz27219. A remote attacker could exploit this vulnerability by sending a large number of specially crafted HTTP requests to cause a denial of service

The MOXA Nport 5110 is a serial communication server. Mosha Technology (Shanghai) Co., Ltd. Nport 5110 device has a blank password vulnerability, allowing an attacker to use this vulnerability to log in to the system background, gain administrator privileges, and obtain device sensitive information

Buffer overflow in the Point-to-Point Protocol over Ethernet (PPPoE) module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600, when CHAP authentication is configured on the server, allows remote attackers to cause a denial of service (server restart) or execute arbitrary code via crafted packets sent during authentication. HuaweiUSG2100 is a unified security gateway product of Huawei Technologies, China. A number of HuaweiUSG products have a buffer overflow vulnerability that allows remote attackers to exploit this vulnerability to submit a special request to crash an application. Multiple Huawei USG Products are prone to a buffer-overflow vulnerability because they fail to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Attackers can exploit this issue to execute arbitrary code in the affected device. Failed exploit attempts will result in denial-of-service conditions. Point-to-Point Protocol over Ethernet (PPPoE) is a PPP protocol (point-to-point connection protocol) used in gateway products such as Huawei USG2100. The following products and versions are affected: Huawei USG2100 V300R001C00, V300R001C10; USG2200V300R001C00, V300R001C10; USG5100V300R001C00, V300R001C10;

Memory leak in Huawei S9300, S5300, S5700, S6700, S7700, S9700, and S12700 devices allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of malformed packets. The Huawei S7700, S9300, S9700, and S12700 are Huawei's intelligent routing switches. A remote denial of service vulnerability exists in several HuaweiSwitches. The following products and versions are affected: Huawei S9300 V200R001C00 , V200R003C00 , V200R005C00 , V200R006C00 , V200R008C00 , S5300 V200R001C00 , V200R002C00 , V200R003C00 , V200R005C00 , V200R005C01 , V200R005C02 , V200R006C00 , V200R007C00 , V200R008C00 , S5700 V200R001C00 , V200R001C01 , V200R002C00 , V200R003C00 , V200R003C02 , V200R005C00 , V200R006C00 , V200R008C00 , S6300 V200R001C00 , V200R002C00 , V200R003C00 , V200R005C00 , V200R005C01 , V200R005C02 , V200R008C00 , S6700 V200R001C00 , V200R001C01 , V200R002C00 , V200R003C00 , V200R008C00 , S7700 V200R001C00 , V200R002C00 , V200R003C00 , V200R005C00 , V200R006C00 , V200R008C00 , S9700 V200R001C00 , V200R001C01 , V200R002C00 , V200R003C00, V200R005C00, V200R006C00, V200R008C00, S12700 V200R005C00, V200R006C00, V200R008C00

Cisco WebEx Meetings Server 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service, aka Bug ID CSCuy92704. Attackers can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCuy92704. Cisco WebEx Meetings Server (CWMS) is a set of multi-functional conference solutions including audio, video and Web conference in Cisco's WebEx conference solution. A denial of service vulnerability exists in CWMS version 2.6

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7119. Vendors have confirmed this vulnerability SVE-2016-7119 It is released as.Denial of service by attacker ( System crash ) It may be put into a state or it may be authorized. SamsungNote is a smartphone released by South Korea's Samsung. Telecom is one of the communication components. Samsung Mobile Phones are prone to multiple denial-of-service vulnerabilities

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7121. Vendors have confirmed this vulnerability SVE-2016-7121 It is released as.Denial of service by attacker ( System crash ) It may be put into a state or it may be authorized. SamsungNote is a smartphone released by South Korea's Samsung. Telecom is one of the communication components. Samsung Mobile Phones are prone to multiple denial-of-service vulnerabilities

The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value. AVer Information EH6108H+ hybrid DVR, version X9.03.24.00.07l and possibly earlier, reportedly contains multiple vulnerabilities, including undocumented privileged accounts, authentication bypass, and information exposure. In addition, JVNVU#95660277 Then CWE-302 It is published as CWE-302: Authentication Bypass by Assumed-Immutable Data http://cwe.mitre.org/data/definitions/302.htmlBy a third party handle By using the value of the parameter, you may be able to bypass the access restriction of the page or change the password. AVerInformationEH6108H+hybridDVRVU is a DVR product from AVerInformation. AVerInformationEH6108H+hybridDVRVU has a certification bypass vulnerability. A hard coded credentials vulnerability. 2. An authentication-bypass vulnerability. 3. An information-disclosure vulnerability. Attackers may exploit these issues to gain unauthorized access to restricted content by bypassing intended security restrictions or to obtain sensitive information and gain root privileges. AVer Information EH6108H+ X9.03.24.00.07l and prior are vulnerable. Version X9.03.24.00.07l and possibly earlier are reported to contain multiple vulnerabilities. Both accounts have root privileges and may be used to gain access via an undocumented telnet service that cannot be disabled through the web user interface and runs by default. CWE-200: Information Exposure - CVE-2016-6537 User credentials are reported to be stored and transmitted in an insecure manner. In the configuration page of the web interface, passwords are stored in base64-encoded strings. In client requests, credentials are listed in plain text in the cookie header. For more information, refer to the researcher's disclosure. Solution: The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround. Restrict access As a general good security practice, only allow connections from trusted hosts and networks. References: http://surveillance.aver.com/model/embedded-hybrid-DVR-EH6108H-plus/ https://www.appsecconsulting.com/blog/easy-root-on-aver-eh6108h-hybrid-dvr-a nd-more https://cwe.mitre.org/data/definitions/798.html https://cwe.mitre.org/data/definitions/302.html https://cwe.mitre.org/data/definitions/200.html

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7120. Vendors have confirmed this vulnerability SVE-2016-7120 It is released as.Denial of service by attacker ( System crash ) It may be put into a state or it may be authorized. SamsungNote is a smartphone released by South Korea's Samsung. Telecom is one of the communication components. Samsung Mobile Phones are prone to multiple denial-of-service vulnerabilities

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings. AVer Information EH6108H+ hybrid DVR, version X9.03.24.00.07l and possibly earlier, reportedly contains multiple vulnerabilities, including undocumented privileged accounts, authentication bypass, and information exposure. AVerInformationEH6108H+hybridDVRVU is a DVR product from AVerInformation. AVerInformationEH6108H+hybridDVR has an information disclosure vulnerability. Attackers can exploit vulnerabilities to obtain sensitive information. A hard coded credentials vulnerability. 2. 3. AVer Information EH6108H+ X9.03.24.00.07l and prior are vulnerable. Version X9.03.24.00.07l and possibly earlier are reported to contain multiple vulnerabilities. Both accounts have root privileges and may be used to gain access via an undocumented telnet service that cannot be disabled through the web user interface and runs by default. CWE-302: Authentication Bypass by Assumed-Immutable Data - CVE-2016-6536 By guessing the handle parameter of the /setup page of the web interface, an unauthenticated attacker reportedly may be able to access restricted pages and alter DVR configurations or change user passwords. CWE-200: Information Exposure - CVE-2016-6537 User credentials are reported to be stored and transmitted in an insecure manner. In the configuration page of the web interface, passwords are stored in base64-encoded strings. In client requests, credentials are listed in plain text in the cookie header. Solution: The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround. Restrict access As a general good security practice, only allow connections from trusted hosts and networks. References: http://surveillance.aver.com/model/embedded-hybrid-DVR-EH6108H-plus/ https://www.appsecconsulting.com/blog/easy-root-on-aver-eh6108h-hybrid-dvr-a nd-more https://cwe.mitre.org/data/definitions/798.html https://cwe.mitre.org/data/definitions/302.html https://cwe.mitre.org/data/definitions/200.html

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session. AVer Information EH6108H+ hybrid DVR, version X9.03.24.00.07l and possibly earlier, reportedly contains multiple vulnerabilities, including undocumented privileged accounts, authentication bypass, and information exposure. Supplementary information : CWE Vulnerability type by CWE-798: Use of Hard-coded Credentials ( Using hard-coded credentials ) Has been identified. AVerInformationEH6108H+hybridDVRVU is a DVR product from AVerInformation. An attacker can exploit the vulnerability to gain root privileges. 2. An authentication-bypass vulnerability. 3. An information-disclosure vulnerability. AVer Information EH6108H+ X9.03.24.00.07l and prior are vulnerable. The vulnerability stems from the fact that the program contains hard-coded accounts. Version X9.03.24.00.07l and possibly earlier are reported to contain multiple vulnerabilities. Both accounts have root privileges and may be used to gain access via an undocumented telnet service that cannot be disabled through the web user interface and runs by default. CWE-302: Authentication Bypass by Assumed-Immutable Data - CVE-2016-6536 By guessing the handle parameter of the /setup page of the web interface, an unauthenticated attacker reportedly may be able to access restricted pages and alter DVR configurations or change user passwords. CWE-200: Information Exposure - CVE-2016-6537 User credentials are reported to be stored and transmitted in an insecure manner. In the configuration page of the web interface, passwords are stored in base64-encoded strings. In client requests, credentials are listed in plain text in the cookie header. For more information, refer to the researcher's disclosure. Solution: The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround. Restrict access As a general good security practice, only allow connections from trusted hosts and networks. References: http://surveillance.aver.com/model/embedded-hybrid-DVR-EH6108H-plus/ https://www.appsecconsulting.com/blog/easy-root-on-aver-eh6108h-hybrid-dvr-a nd-more https://cwe.mitre.org/data/definitions/798.html https://cwe.mitre.org/data/definitions/302.html https://cwe.mitre.org/data/definitions/200.html