VARIoT IoT vulnerabilities database

A vulnerability, which was classified as critical, has been found in D-Link DAP-1562 1.10. Affected by this issue is the function http_request_parse of the component HTTP Header Handler. The manipulation of the argument Authorization leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link DAP-1562 is a wireless bridge produced by D-Link of China. The vulnerability is caused by a stack buffer overflow in the HTTP Header Handler, which may lead to remote attacks. Attackers can use this vulnerability to execute arbitrary code on the device, resulting in damage to the confidentiality, integrity and availability of the device

Memory corruption while processing input message passed from FE driver. MSM8996AU firmware, qam8255p firmware, QAM8295P Multiple Qualcomm products, including firmware, contain vulnerabilities related to input validation and out-of-bounds writing.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Transient DOS may occur while processing the country IE. QCA9367 firmware, QCA9377 firmware, qcc2073 Multiple Qualcomm products such as firmware have a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state

While processing the authentication message in UE, improper authentication may lead to information disclosure. 315 5g iot firmware, 9205 lte firmware, AR8035 Multiple Qualcomm products, such as firmware, contain vulnerabilities related to authentication.Information may be obtained

A vulnerability was found in Tenda AC8 16.03.34.06 and classified as critical. This issue affects the function sub_49E098 of the file /goform/SetIpMacBind of the component Parameter Handler. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of AC8 The firmware contains a buffer error vulnerability and a stack-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A vulnerability, which was classified as critical, was found in Tenda AC7 up to 15.03.06.44. This affects the function formSetFirewallCfg of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Tenda AC7 is a wireless router produced by Tenda. In Tenda AC7 15.03.06.44 and earlier versions, the formSetFirewallCfg function of the /goform/SetFirewallCfg file has a stack overflow vulnerability when processing the firewallEn parameter. The vulnerability is caused by the program's failure to check the parameter length. Attackers can use this vulnerability to launch attacks remotely and achieve code execution

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics ISPSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of CBDGL files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics ISPSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DVP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics ISPSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DVP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

A vulnerability, which was classified as critical, was found in Tenda AC7 1200M 15.03.06.44. Affected is the function TendaTelnet of the file /goform/telnet. The manipulation of the argument lan_ip leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Tenda AC7 is a wireless router from China's Tenda company. The vulnerability is caused by the TendaTelnet function in the /goform/telnet file failing to properly filter special characters and commands in the constructed command. Attackers can exploit this vulnerability to cause arbitrary command execution

TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the pppoe_dns1 parameter in the formIpv6Setup interface of /bin/boa. TOTOLINK A3002R is a wireless router from China's TOTOLINK Electronics. Remote attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack

TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_gw parameter in the formIpv6Setup interface of /bin/boa. TOTOLINK A3002R is a wireless router from China's TOTOLINK Electronics. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_ipv6 parameter in the formIpv6Setup interface of /bin/boa. TOTOLINK A3002R is a wireless router from China's TOTOLINK Electronics. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside the have_same_name function on the /addschedule.htm page. TRENDnet TEW-929DRU is a wireless router from TRENDnet, an American company. Attackers can exploit this vulnerability to execute arbitrary web scripts or HTML by injecting carefully designed payloads

Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_data parameter on the /captive_portal.htm page. TRENDnet TEW-929DRU is a wireless router from TRENDnet, an American company. TRENDnet TEW-929DRU has a cross-site scripting vulnerability. Attackers can exploit this vulnerability to execute arbitrary web scripts or HTML by injecting carefully designed payloads

HP LaserJet M211dw is a printer product. HP LaserJet M211dw of HP Trading (Shanghai) Co., Ltd. has an unauthorized access vulnerability, which can be exploited by attackers to obtain sensitive information.

Beijing Huali Chuangtong Technology Co., Ltd. (hereinafter referred to as Huali Chuangtong) is a leader in information technology and innovative applications for domestic defense, government and industry. Beijing Huali Chuangtong Technology Co., Ltd.'s 6100 satellite mobile terminal has a command execution vulnerability, which can be exploited by attackers to execute arbitrary commands.

Beijing Xingwang Ruijie Network Technology Co., Ltd. is a provider of ICT infrastructure and industry solutions. Its main business is the research, design and sales of network equipment, network security products and cloud desktop solutions. Beijing Xingwang Ruijie Network Technology Co., Ltd. RG-UAC-6000-E20 has a command execution vulnerability, which can be exploited by attackers to execute arbitrary commands.

SNC-RZ50N is a network camera with day and night switching function. Sony Group Corporation SNC-RZ50N has a weak password vulnerability, which can be exploited by attackers to obtain sensitive information.

SAMSUNG X6250 is an all-in-one computer. SAMSUNG X6250 has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information.