VARIoT IoT vulnerabilities database

Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.110.0, 8.2.12x before 8.2.121.0, and 8.3.x before 8.3.102.0 allow local users to gain privileges via crafted CLI parameters, aka Bug ID CSCuz24725. Cisco Aironet 1800 , 2800 ,and 3800 The device software contains a privileged vulnerability. Cisco Aironet AccessPoints is a set of wireless access point devices from Cisco. A local attacker could exploit this vulnerability to gain root privileges on the device. This issue is being tracked by Cisco Bug ID CSCuz24725. Cisco Aironet 1800 , 2800 and 3800 Both are American Cisco ( Cisco ) company's router. The following products are affected: using 8.2.110.0 Version, 8.2.121.0 previous 8.2.12x Version, 8.3.102.0 previous 8.3.x version software Cisco Aironet 1800 , 2800 and 3800 equipment

Huawei AC6003, AC6005, AC6605, and ACU2 access controllers with software before V200R006C10SPC200 allows remote authenticated users to cause a denial of service (device restart) via crafted CAPWAP packets. HuaweiAccessControllersAC6003 is a wireless access controller of China Huawei. A denial of service vulnerability exists in several Huawei products. Multiple Huawei Access Controllers are prone to a denial-of-service vulnerability. An attacker can exploit this issue to restart the device, resulting in denial-of-service condition. The following products using software versions earlier than V200R006C10SPC200 are affected: Huawei AC6003, AC6005, AC6605, and ACU2

Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, and RH2288H V3 servers with software before V100R003C00SPC515 allow remote attackers to obtain passwords via a brute-force attack, related to "lack of authentication protection mechanisms.". plural Huawei Product software includes " Missing authentication protection mechanism " There is a vulnerability in password acquisition due to incomplete processing. Supplementary information : CWE Vulnerability type by CWE-285: Improper Authorization ( Inappropriate authentication ) Has been identified. http://cwe.mitre.org/data/definitions/285.htmlRound robin by a third party (brute-force) A password may be obtained through an attack. Huawei is a Chinese provider of information and communication solutions. An authentication bypass vulnerability exists in multiple Huawei servers, and an attacker can exploit this vulnerability to bypass the authentication mechanism. Huawei XH628 and others are all servers of China Huawei (Huawei). There are brute force cracking attack vulnerabilities in several Huawei servers. A remote attacker could exploit this vulnerability to obtain passwords through a brute force attack. The following products and versions are affected: Huawei XH620 V3, XH622 V3, XH628 V3 earlier than V100R003C00SPC610, RH1288 V3 earlier than V100R003C00SPC613, RH2288 V3 earlier than V100R003C00SPC617, and RH2288H V3 earlier than V100R003C

Huawei X6800 and XH620 V3 servers with software before V100R003C00SPC606, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, CH140 V3 and CH226 V3 servers with software before V100R001C00SPC122, CH220 V3 servers with software before V100R001C00SPC201, and CH121 V3 and CH222 V3 servers with software before V100R001C00SPC202 might allow remote attackers to decrypt encrypted data and consequently obtain sensitive information by leveraging selection of an insecure SSH encryption algorithm. plural Huawei Server software contains a vulnerability that can decrypt encrypted data and, as a result, retrieve important information.Insecure by third parties SSH By choosing an encryption algorithm, you may be able to decrypt the encrypted data and thereby obtain important information. The Huawei XH620 and X6800 are both server products of China's Huawei company. An information disclosure vulnerability exists in the HuaweiXH620 and X6800 that allows an attacker to exploit the vulnerability to obtain sensitive information or to initiate further attacks. Multiple Huawei Products are prone to an information-disclosure vulnerability. The following products and versions are affected: Huawei X6800 and H620 V3 V100R003C00SPC606 previous version, RH1288 V3 V100R003C00SPC613 previous version, RH2288 V3 V100R003C00SPC617 previous version, CH140 V3 and CH226 V3 V100R001C00SPC122 previous version, CH220 V3 V100R001C00SPC201 previous version, CH121 V3 and versions earlier than CH222 V3 V100R001C00SPC202

The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 allows remote authenticated users to execute arbitrary commands as root via crafted HTTP requests, aka Bug ID CSCur25513. Vendors have confirmed this vulnerability Bug ID CSCur25513 It is released as.Crafted by remotely authenticated users HTTP Any command via request root May be executed as. An attacker can exploit this issue to execute arbitrary code on the affected system with root privileges. This may aid in further attacks. This issue being tracked by Cisco Bug ID CSCur25513

The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.0.3, 5.3.1.x before 5.3.1.2, and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.0.3, 5.3.1.x before 5.3.1.2, and 5.4.x before 5.4.0.1 allows remote authenticated users to increase user-account privileges via crafted HTTP requests, aka Bug ID CSCur25483. Vendors have confirmed this vulnerability Bug ID CSCur25483 It is released as.Crafted by remotely authenticated users HTTP User account privileges may be expanded through requests. An attacker can exploit this issue to gain elevated privileges on an affected device. This issue is being tracked by Cisco Bug ID CSCur25483

Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON. Bug ID CSCva92151 or EXTRABACON It is published as.A remote authenticated user may be able to exploit IPv4 SNMP Arbitrary code may be executed via packets. The CiscoASA5500 Series Adaptive Security Appliance is a modular platform for providing security and VPN services with firewall, IPS, anti-X and VPN services. A remote code execution vulnerability exists in the SNMP code for CiscoAdaptiveSecurityAppliance(ASA)Software. Cisco Adaptive Security Appliance products are prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. This issue being tracked by Cisco Bug ID CSCva92151

The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls, aka Bug ID CSCux67855. Cisco Unified Communications Manager is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCux67855. Cisco Unified Communications Manager 11.5 is vulnerable. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCur25508 and CSCur25518. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. This issue is being tracked by Cisco Bug IDs CSCur25508 and CSCur25518

Cisco WebEx Meetings Server 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vectors, aka Bug ID CSCuy92724. Cisco WebEx Meetings Server is prone to an information-disclosure vulnerability. An attacker can exploit this issue to obtain sensitive information that may aid in further attacks. This issue is being tracked by Cisco bug ID CSCuy92724. Cisco WebEx Meetings Server (CWMS) is a set of multi-functional conference solutions including audio, video and Web conference in Cisco's WebEx conference solution. An information disclosure vulnerability exists in CWMS version 2.6

Cisco IP Phone 8800 devices with software 11.0(1) allow remote attackers to cause a denial of service (memory corruption) via a crafted HTTP request, aka Bug ID CSCuz03038. The Cisco IP8800 Series Phones are digital phone system products. This issue is tracked by Cisco Bug ID CSCuz03038

Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine 1.3(0.876) allows remote attackers to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCva46497. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCva46497. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies

Cross-site scripting (XSS) vulnerability in Cisco Transport Gateway Installation Software 4.1(4.0) on Smart Call Home Transport Gateway devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug IDs CSCva40650 and CSCva40817. Vendors have confirmed this vulnerability Bug ID CSCva40650 and CSCva40817 It is released as.Any value via a crafted value by a third party Web Script or HTML May be inserted. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. This issue is being tracked by Cisco Bug IDs CSCva40650 and CSCva40817

The rate-limit feature in the 802.11 protocol implementation on Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.121.0 and 8.3.x before 8.3.102.0 allows remote attackers to cause a denial of service (device reload) via crafted 802.11 frames, aka Bug ID CSCva06192. Cisco Aironet AccessPoint is a small and medium-sized wireless network access point product. Cisco Aironet Access Points is prone to a denial-of-service vulnerability. Attackers can exploit this issue to reload the affected device, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCva06192. Cisco Aironet 1800, 2800, and 3800 are all routers of Cisco (Cisco). Limit the speed of 802.11 traffic

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method. FirewallD is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: firewalld security, bug fix, and enhancement update Advisory ID: RHSA-2016:2597-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2597.html Issue date: 2016-11-03 CVE Names: CVE-2016-5410 ===================================================================== 1. Summary: An update for firewalld is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch Red Hat Enterprise Linux Client Optional (v. 7) - noarch Red Hat Enterprise Linux ComputeNode (v. 7) - noarch Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Enterprise Linux Server Optional (v. 7) - noarch Red Hat Enterprise Linux Workstation (v. 7) - noarch Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch 3. Description: firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. The following packages have been upgraded to a newer upstream version: firewalld (0.4.3.2). Any locally logged in user could use this flaw to tamper or change firewall settings. (CVE-2016-5410) Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1066037 - firewall-config should allow unspecifying zone binding for interface 1136801 - a rule added into IN_<zone>_allow chain with 'permanent direct' interface doesn't exist after reload 1147500 - RFE: add command to firewall-cmd showing details of a service 1147951 - firewall-cmd should support a default logging option. 1219717 - Add radius TCP to policy. 1220196 - Firewalld missing policies for imap and smtps 1220467 - Option '--quiet' is needed in firewall-offline-cmd command line. 1237242 - Error: RT_TO_PERM_FAILED: zone 'dmz' : ZONE_CONFLICT when doing --runtime-to-permanent 1273296 - [ALL_LANG][firewalld] Translation incomplete 1273888 - Firewalld DefaultZone change breaking on --reload 1281416 - Headless firewall-config over ssh. firewall-config missing dependencies 1285769 - Fails to start without ip6t_rpfilter module 1292926 - firewalld --new-service & malformed xml ?? 1296573 - xsd specification nor service daemon checks whether tags are specified more than once if they must not 1301573 - firewalld reporting errors in logs for failed iptables commands 1302802 - Rebase to the new upstream and new release 1303026 - firewalld - mistake in <ports> renders ports remain closed, silently. 1305434 - Firewalld hangs with a NIS configuration 1313023 - command "systemctl reload firewalld" stops firewalld 1313845 - Backport After=dbus.service 1325335 - [RFE] allow negation of icmp-blocks zone configuration field 1326130 - firewalld stops traffic from/to 127.0.0.1 when masquerading is enabled in default zone 1326462 - rich rule with destination and no element give error 1347530 - Add port for corosync-qnetd to high-availability service 1349903 - FirewallD fails to parse direct rules with a lot of destination addresses 1357050 - exit codes don't match error messages in firewall-cmd 1360135 - CVE-2016-5410 firewalld: Firewall configuration can be modified by any logged in user 1360894 - Print errors and warnings to stderr 1365198 - firewall-cmd ipset --add-entries-from-file broken 1367038 - firewall-cmd crashes if /run/dbus/system_bus_socket does not exist 1368949 - Trying to get the description for a firewalld zone from command line throws error and prints traceback information. 1371116 - Load helper modules in FirewallZoneTransaction 1373260 - An error in the permanent direct rules will make all other direct rules using a table other than the filter table not applicable. 1374799 - exclude firewallctl from firewalld v0.4.3.2 update 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: firewalld-0.4.3.2-8.el7.src.rpm noarch: firewall-config-0.4.3.2-8.el7.noarch.rpm firewalld-0.4.3.2-8.el7.noarch.rpm firewalld-filesystem-0.4.3.2-8.el7.noarch.rpm python-firewall-0.4.3.2-8.el7.noarch.rpm Red Hat Enterprise Linux Client Optional (v. 7): noarch: firewall-applet-0.4.3.2-8.el7.noarch.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: firewalld-0.4.3.2-8.el7.src.rpm noarch: firewalld-0.4.3.2-8.el7.noarch.rpm firewalld-filesystem-0.4.3.2-8.el7.noarch.rpm python-firewall-0.4.3.2-8.el7.noarch.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): noarch: firewall-applet-0.4.3.2-8.el7.noarch.rpm firewall-config-0.4.3.2-8.el7.noarch.rpm Red Hat Enterprise Linux Server (v. 7): Source: firewalld-0.4.3.2-8.el7.src.rpm noarch: firewall-config-0.4.3.2-8.el7.noarch.rpm firewalld-0.4.3.2-8.el7.noarch.rpm firewalld-filesystem-0.4.3.2-8.el7.noarch.rpm python-firewall-0.4.3.2-8.el7.noarch.rpm Red Hat Enterprise Linux Server Optional (v. 7): noarch: firewall-applet-0.4.3.2-8.el7.noarch.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: firewalld-0.4.3.2-8.el7.src.rpm noarch: firewall-config-0.4.3.2-8.el7.noarch.rpm firewalld-0.4.3.2-8.el7.noarch.rpm firewalld-filesystem-0.4.3.2-8.el7.noarch.rpm python-firewall-0.4.3.2-8.el7.noarch.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): noarch: firewall-applet-0.4.3.2-8.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-5410 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYGvz+XlSAg2UNWIIRAnYNAKC+tOJpkB9nwgqe+K/AaoZBzPX3RQCeM8De T81FpcV1vTa45DoiZC5wdUk= =+0pl -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201701-70 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Firewalld: Improper authentication methods Date: January 29, 2017 Bugs: #591458 ID: 201701-70 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A vulnerability in Firewalld allows firewall configurations to be modified by unauthenticated users. Background ========== Firewalld provides a dynamically managed firewall with support for network/firewall zones to define the trust level of network connections or interfaces. This is due to how Firewalld handles authentication via polkit which is not properly applied to 5 particular functions to include: addPassthrough, removePassthrough, addEntry, removeEntry, and setEntries. Impact ====== A local attacker could tamper or change firewall settings leading to the additional exposure of systems to include unauthorized remote access. Workaround ========== There is no known workaround at this time. Resolution ========== All Firewalld users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-firewall/firewalld-0.4.3.3"= References ========== [ 1 ] CVE-2016-5410 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5410 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201701-70 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --0Gjuansk3tW7pCmf5JAuWnfVtAeiNASDT--

Trend Micro InterScan Messaging Security Virtual Appliance is prone to the following security vulnerabilities: 1. A cross-site scripting vulnerability 2. An open-redirection vulnerability 3. Multiple security vulnerabilities An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, this may allow the attacker to steal cookie-based authentication credentials, to bypass the authentication mechanism and to launch other attacks or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site. Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 8.5 are vulnerable.

Trend Micro InterScan Messaging Security Virtual Appliance is prone to the following security vulnerabilities: 1. A cross-site scripting vulnerability 2. An open-redirection vulnerability 3. Multiple security vulnerabilities An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, this may allow the attacker to steal cookie-based authentication credentials, to bypass the authentication mechanism and to launch other attacks or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site. Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 8.5 are vulnerable.

Trend Micro InterScan Messaging Security Virtual Appliance is prone to the following security vulnerabilities: 1. A cross-site scripting vulnerability 2. An open-redirection vulnerability 3. Multiple security vulnerabilities An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, this may allow the attacker to steal cookie-based authentication credentials, to bypass the authentication mechanism and to launch other attacks or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site. Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 8.5 are vulnerable.

Mitsubishi L06 is a high-end PLC of Mitsubishi. Its Ethernet communication module LJ71E71-100-CM opens web services and supports http protocol communication. You can access and set device configuration information by logging in to the web server. In the HTTP message sent to the LJ71E71-100-CM, if it is a Connect type request, injecting a long string after the Connect field can trigger a buffer overflow of the communication module and there is a security vulnerability. Allowing an attacker to exploit this vulnerability results in a denial of service

FX3U is a high-end PLC of Mitsubishi, and its transmission layer uses COTP protocol for communication. A buffer overflow vulnerability exists in the COTP protocol packets that are sent to the FX3U's Ethernet port in a cyclically restructured packet. Allowing an attacker to exploit this vulnerability results in a denial of service