VARIoT IoT vulnerabilities database

A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Discovery Protocol. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Systems, Inc. OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A vulnerability has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formeditFileName of the file /goform/editFileName. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. of ch22 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A vulnerability was identified in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function formdelFileName of the file /goform/delFileName. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

A vulnerability has been found in Tenda G1 16.01.7.8(3660). Affected by this issue is the function check_upload_file of the component Firmware Update Handler. The manipulation leads to insufficient verification of data authenticity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of G1 Firmware contains insufficient validation of data authenticity.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A vulnerability was identified in Tenda AC15 15.13.07.13. Affected by this vulnerability is the function check_fw_type/split_fireware/check_fw of the component Firmware Update Handler. The manipulation leads to insufficient verification of data authenticity. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of AC15 Firmware contains insufficient validation of data authenticity.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The D-Link DIR-818L is a Wi-Fi router manufactured by D-Link, a Chinese company. The D-Link DIR-818L has an injection vulnerability due to incorrect operation of the /htdocs/cgibin file. An attacker can exploit this vulnerability by injecting malicious SQL statements, bypassing authentication and accessing restricted data

A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_response.cgi of the component httpd. The manipulation of the argument ping_ipaddr leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Systems, Inc. of DIR-825 The firmware contains a buffer error vulnerability and a stack-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The D-Link DIR-825 is a router manufactured by D-Link, a Chinese company. An attacker could exploit this vulnerability to corrupt memory, causing a system crash and disrupting service operations

A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this vulnerability is the function strcpy of the file /goform/saveParentControlInfo. The manipulation of the argument Time leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The Tenda AC20 is a wireless router from the Chinese company Tenda. The Tenda AC20 suffers from a buffer overflow vulnerability caused by a failure to properly validate the length of input data in the "Time" parameter in the file /goform/saveParentControlInfo. This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service (DoS)

A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The TOTOLINK N350R is a WiFi router manufactured by the Chinese company TOTOLINK. An attacker could exploit this vulnerability to inject malicious code, causing the application to crash or behave abnormally

The Desigo CC product family includes Desigo CC (an integrated building management platform for managing high-performance buildings), Desigo CC Compact (a solution tailored for small and medium-sized buildings), Desigo CC Connect (a software gateway based on the Desigo CC platform), and Cerberus DMS (a hazard management station that helps users manage fire safety and security incidents). SENTRON Powermanager power monitoring software analyzes energy consumption by displaying key characteristics of individual devices and the entire system in an easy-to-understand dashboard. A privilege escalation vulnerability exists in the SIEMENS Desigo CC family and SENTRON Powermanager, which could be exploited by an attacker to escalate privileges.

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wps_set in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack. Netis Systems Co., Ltd. The Netis WF2880 is a wireless router from the Chinese company Netis

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046f984 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_advanced_set in the payload, which can cause the program to crash and lead to a Denial of Service (DoS) attack. Netis Systems Co., Ltd. of WF2880 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. The Netis WF2880 is a wireless router from the Chinese company Netis

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_mac_filter_set in the payload, which can cause the program to crash and lead to a Denial of Service (DoS) attack. Netis Systems Co., Ltd. of WF2880 Firmware has a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state. The Netis WF2880 is a wireless router from the Chinese company Netis

In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. TOTOLINK of ex1200t There are unspecified vulnerabilities in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The TOTOLINK EX1200T is a Wi-Fi range extender manufactured by the Chinese company TOTOLINK. The TOTOLINK EX1200T suffers from an authentication bypass vulnerability. This vulnerability stems from the formLoginAuth.htm file not properly validating login requests. An attacker could exploit this vulnerability to bypass authentication, gain administrator privileges, and potentially control the entire system

In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm. TOTOLINK of a7000r There are unspecified vulnerabilities in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The TOTOLINK A7000R is a wireless router manufactured by the Chinese company TOTOLINK. The TOTOLINK A7000R suffers from an authentication bypass vulnerability caused by the formLoginAuth.htm file not properly validating login requests. Attackers can exploit this vulnerability to bypass authentication, tamper with system configurations, and potentially insert malware

A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_0047151c function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wds_set in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack. Netis Systems Co., Ltd. of WF2880 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. The Netis WF2880 is a wireless router from the Chinese company Netis

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00475e1c function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wds_key_wep in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack. Netis Systems Co., Ltd. of WF2880 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. The Netis WF2880 is a wireless router from the Chinese company Netis

A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_004743f8 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_sec_set in the payload, which may cause the program to crash and potentially lead to a Denial of Service (DoS) attack. Netis Systems Co., Ltd. of WF2880 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. The Netis WF2880 is a wireless router from the Chinese company Netis

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00473154 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_sec_set_5g and wl_sec_rp_set_5g in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack. Netis Systems Co., Ltd. of WF2880 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. The Netis WF2880 is a wireless router from the Chinese company Netis

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00476598 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_base_set_5g in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack. The Netis WF2880 is a wireless router from the Chinese company Netis