VARIoT IoT vulnerabilities database

A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. TP-LINK Technologies of er7206 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TP-LINK ER7206 is a multifunctional Gigabit router from China TP-LINK Company. TP-LINK ER7206 1.3.0 build 20230322 Rel.70591 version has an operating system command injection vulnerability

A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. TP-LINK Technologies of er7206 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TP-LINK ER7206 is a multifunctional Gigabit router from China TP-LINK Company. TP-LINK ER7206 1.3.0 build 20230322 Rel.70591 version has an operating system command injection vulnerability

A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection . An attacker can make an authenticated HTTP request to trigger this vulnerability. TP-LINK Technologies of er7206 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TP-LINK ER7206 is a multifunctional Gigabit router from China TP-LINK Company. There is an input validation vulnerability in the TP-LINK ER7206 wireguard VPN configuration. A remote attacker can exploit this vulnerability to submit special requests and execute arbitrary code in the application context

A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. TP-LINK Technologies of er7206 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TP-LINK ER7206 is a multifunctional Gigabit router from China TP-LINK Company. TP-LINK ER7206 1.3.0 build 20230322 Rel.70591 version has an operating system command injection vulnerability

Memory corruption in Audio while processing the calibration data returned from ACDB loader. 9206 lte modem firmware, AQT1000 firmware, AR8035 Multiple Qualcomm products such as firmware have a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Memory corruption in Audio while processing IIR config data from AFE calibration block. 9206 lte modem firmware, AQT1000 firmware, AR8035 Multiple Qualcomm products such as firmware have a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points. 9206 lte modem firmware, AQT1000 firmware, AR8035 Several Qualcomm products, such as firmware, contain an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Information disclosure in Audio while accessing AVCS services from ADSP payload. AQT1000 firmware, AR8035 firmware, c-v2x 9150 Multiple Qualcomm products, such as firmware, contain an out-of-bounds read vulnerability.Information is obtained and service operation is interrupted (DoS) It may be in a state

Transient DOS in Audio when invoking callback function of ASM driver. AQT1000 firmware, AR8035 firmware, c-v2x 9150 Multiple Qualcomm products, such as firmware, contain an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be in a state

Implicit intent hijacking vulnerability in IAP of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent. Samsung's Galaxy Store Exists in unspecified vulnerabilities.Information may be obtained

Implicit intent hijacking vulnerability in VoiceSearch of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent. Samsung's Galaxy Store Exists in unspecified vulnerabilities.Information may be obtained

Implicit intent hijacking vulnerability in SamsungAccount of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent. Samsung's Galaxy Store Exists in unspecified vulnerabilities.Information may be obtained

Implicit intent hijacking vulnerability in AccountActivity of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent. Samsung's Galaxy Store Exists in unspecified vulnerabilities.Information may be obtained

Agile Controller is an automation controller suitable for various industrial application scenarios. There is a command execution vulnerability in Huawei Technologies Co., Ltd. Agile Controller. An attacker can use this vulnerability to gain server permissions.

Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4 allows physical attackers to access the picture using physical keyboard on the lockscreen. Samsung's Gallery Exists in unspecified vulnerabilities.Information may be obtained

RG-UAC Ruijie unified online behavior management and audit system is an online behavior management and audit product. There is a command execution vulnerability in the RG-UAC Ruijie unified Internet behavior management and auditing system of Beijing StarNet Ruijie Network Technology Co., Ltd. An attacker can use this vulnerability to obtain server permissions.

In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Connection Setup message, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01191612; Issue ID: MOLY01195812 (MSV-985). media tech's NR15 There is an input validation vulnerability in.Service operation interruption (DoS) It may be in a state

Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi allows a remote attacker to cause a denial of service or run arbitrary code via crafted overflow data. Shenzhen Tenda Technology Co.,Ltd. of AC9 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda AC9 has a buffer overflow vulnerability. The vulnerability stems from the failure of the setSchedWifi function to correctly verify the length of input data

In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Connection Setup message, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01191612; Issue ID: MOLY01191612 (MSV-981). media tech's NR15 There is an input validation vulnerability in.Service operation interruption (DoS) It may be in a state

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account with an empty password. IBM X-Force ID: 266154. (DoS) It may be in a state