VARIoT IoT vulnerabilities database

A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this vulnerability is the function form_portforwarding of the file /goform/form_portforwarding. The manipulation of the argument ingress_name_%d/sched_name_%d/name_%d leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Systems, Inc. of DIR-619L The firmware contains a buffer error vulnerability and a stack-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The D-Link DIR-619L is a wireless router designed for home and small office environments. It implements the IEEE 802.11n wireless standard and offers a maximum transmission rate of 300Mbps. This vulnerability occurs because the form_portforwarding method in the file /goform/form_portforwarding fails to properly validate the length of input data. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. Affected is the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of fh1203 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by the parameter lanMask of the fromadvsetlanip function in the file /goform/AdvSetLanip failing to correctly verify the length of the input data. Remote attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack

A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7. This issue affects the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of fh1205 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. tenda FH1205 is a dual-band wireless router for home users, with high cost performance and stable network performance. Attackers can use this vulnerability to trigger a buffer overflow by manipulating the parameter lanMask

A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of fh1205 The firmware contains a buffer error vulnerability, a stack-based buffer overflow vulnerability, and an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by the fact that the parameter page of the VirtualSer function in the file /goform/VirtualSer fails to correctly verify the length of the input data. A remote attacker can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack

A vulnerability classified as critical has been found in Tenda FH1201 1.2.0.14(408). This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of fh1201 The firmware contains a buffer error vulnerability, a stack-based buffer overflow vulnerability, and an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by the page parameter of the /goform/SafeMacFilter file failing to properly verify the length of the input data. A remote attacker can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack

RG-EW1200G is a home wireless router suitable for use in flat homes, villas, small shops and SOHO offices. RG-EW1200G of Beijing Xingwang Ruijie Network Technology Co., Ltd. has a command execution vulnerability, which can be exploited by attackers to obtain server permissions.

Xerox Altalink C8245 is a multi-function laser printer with high-speed printing, copying and scanning functions, suitable for small and medium-sized enterprises or office environments. Fujifilm Business Innovation (China) Co., Ltd. Xerox Altalink C8245 has a denial of service vulnerability, and attackers can exploit the vulnerability to cause printer service interruption.

DIR-823X (AX3000) is a dual-band wireless router that supports the WiFi 6 standard and has a dual-band concurrent rate of up to 3000Mbps. DIR-823X (AX3000) of D-Link Electronics (Shanghai) Co., Ltd. has a command execution vulnerability that can be exploited by attackers to execute commands.

DIR-823X (AX3000) is a dual-band wireless router that supports the WiFi 6 standard and has a dual-band concurrent rate of up to 3000Mbps. DIR-823X (AX3000) of D-Link Electronics (Shanghai) Co., Ltd. has a command execution vulnerability that can be exploited by attackers to execute commands.

Xerox Altalink B415 is a multi-function laser printer with printing, copying, scanning and faxing functions. Fujifilm Business Innovation (China) Co., Ltd. Xerox Altalink B415 has a denial of service vulnerability, and attackers can exploit the vulnerability to cause printer service interruption.

LOYTEC LINX-202 is a building automation server, mainly used in building automation systems. Delta Electronics (Dongguan) Co., Ltd. LOYTEC LINX-202 has a weak password vulnerability, which can be exploited by attackers to log in to the system and obtain sensitive information.

e-STUDIO3008A is an A3-sized black-and-white digital multifunction machine with printing, copying and scanning functions. Toshiba (China) Co., Ltd. Shanghai Branch e-STUDIO3008A has a weak password vulnerability, which can be exploited by attackers to log in to the system and obtain sensitive information.

H3C Magic NX15000 10G Wi-Fi 6 Router is a high-end router for users and groups who pursue full-house coverage and high-quality networks. H3C Magic NX15000 10G Wi-Fi 6 Router of H3C Technologies Co., Ltd. has an information leakage vulnerability, which can be exploited by attackers to obtain sensitive information.

The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress plugin is an application plugin. The WordPress DIOT SCADA with MQTT plugin has a cross-site scripting vulnerability. The vulnerability is caused by the lack of effective filtering and escaping of user-supplied data in the application

In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege. Tenable Agent is a vulnerability scanner developed by the US company Tenable. Detailed vulnerability details are not available at this time

Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component. TOTOLINK of n600r Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK N600R is a wireless router from China's TOTOLINK Electronics. TOTOLINK N600R V4.3.0cu.7866_B2022506 has a buffer overflow vulnerability. The vulnerability is caused by the UPLOAD_FILENAME component failing to properly verify the length of the input data

Tatung World Technology Co., Ltd. has two main entities: one is a listed company headquartered in Taiwan, China (established in 2000), and the other is a newly established company located in Hunan (established in 2025). The Taiwanese company focuses on telecommunications and system integration services and ranks among the top five system integrators in Taiwan; the Hunan company focuses on computer system security and biotechnology. Tatung World Technology Co., Ltd. Tatung lOT Edge Setting has a command execution vulnerability, which can be exploited by attackers to execute arbitrary code.

Canon iR-ADV C5535 is a high-performance color digital multifunction machine with multiple functions such as copying, printing, scanning and faxing. Canon iR-ADV C5535 of Canon (China) Co., Ltd. has a weak password vulnerability. Attackers can use the vulnerability to log in to the system and obtain sensitive information.

Suzhou Keda Technology Co., Ltd. is a leading provider of video and security products and solutions. There is a logic defect vulnerability in the MSS streaming media server of Suzhou Keda Technology Co., Ltd., which can be exploited by attackers to illegally create new user accounts and elevate permissions when logging in.

H3C Magic NX15000 is a 10G Wi-Fi 6 router. H3C Magic NX15000 of H3C Technologies Co., Ltd. has a command execution vulnerability, which can be exploited by attackers to obtain server permissions.