Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-202208-2176 CVE-2022-38511 TOTOLINK  of  a810r  in the firmware  OS  Command injection vulnerability CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi. TOTOLINK of a810r The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-2069 CVE-2022-36616 TOTOLINK  of  a810r  Vulnerability related to use of hardcoded credentials in firmware CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample. TOTOLINK of a810r A vulnerability exists in the firmware regarding the use of hardcoded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-2068 CVE-2022-36756 D-Link Systems, Inc.  of  dir-845l  Code injection vulnerability in firmware CVSS V2: -
CVSS V3: 9.8
Severity: CRITICAL
DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php. D-Link Systems, Inc. of dir-845l A code injection vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-2019 CVE-2022-38570 Shenzhen Tenda Technology Co.,Ltd.  of  m3  Out-of-bounds write vulnerability in firmware CVSS V2: -
CVSS V3: 7.5
Severity: HIGH
Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelPushedAd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the adPushUID parameter. Shenzhen Tenda Technology Co.,Ltd. of m3 An out-of-bounds write vulnerability exists in firmware.Service operation interruption (DoS) It may be in a state
VAR-202208-2047 CVE-2022-37053 TRENDnet  of  TEW733GR  Code injection vulnerability in firmware CVSS V2: -
CVSS V3: 9.8
Severity: CRITICAL
TRENDnet TEW733GR v1.03B01 is vulnerable to Command injection via /htdocs/upnpinc/gena.php. TRENDnet of TEW733GR A code injection vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-2139 CVE-2022-38555 Cisco Systems  (Linksys)  of  E1200  Out-of-bounds write vulnerability in firmware CVSS V2: -
CVSS V3: 9.8
Severity: CRITICAL
Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name. Cisco Systems (Linksys) of E1200 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-2044 CVE-2022-38569 Shenzhen Tenda Technology Co.,Ltd.  of  m3  Out-of-bounds write vulnerability in firmware CVSS V2: -
CVSS V3: 7.5
Severity: HIGH
Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelAd. Shenzhen Tenda Technology Co.,Ltd. of m3 An out-of-bounds write vulnerability exists in firmware.Service operation interruption (DoS) It may be in a state
VAR-202208-2087 CVE-2022-38557 D-Link Systems, Inc.  of  dir-845l  Authentication vulnerability in firmware CVSS V2: -
CVSS V3: 9.8
Severity: CRITICAL
D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. D-Link Systems, Inc. of dir-845l An authentication vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-1994 CVE-2022-38510 Shenzhen Tenda Technology Co.,Ltd.  of  tx9 pro  Classic buffer overflow vulnerability in firmware CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList. Shenzhen Tenda Technology Co.,Ltd. of tx9 pro Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-2049 CVE-2022-38564 Shenzhen Tenda Technology Co.,Ltd.  of  m3  Out-of-bounds write vulnerability in firmware CVSS V2: -
CVSS V3: 7.5
Severity: HIGH
Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow vulnerability in the function formSetPicListItem. This vulnerability allows attackers to cause a Denial of Service (DoS) via the adItemUID parameter. Shenzhen Tenda Technology Co.,Ltd. of m3 An out-of-bounds write vulnerability exists in firmware.Service operation interruption (DoS) It may be in a state
VAR-202208-2082 CVE-2022-2915 plural  SonicWALL  Out-of-bounds write vulnerabilities in the product CVSS V2: -
CVSS V3: 8.8
Severity: HIGH
A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier versions. SMA200 firmware, SMA210 firmware, SMA400 firmware etc. SonicWALL The product contains a vulnerability related to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-2056 CVE-2022-36522 MikroTik  of  routeros  Reachable Assertiveness Vulnerability in CVSS V2: -
CVSS V3: 6.5
Severity: MEDIUM
Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. MikroTik of routeros Exists in a reachable assertiveness vulnerability.Service operation interruption (DoS) It may be in a state
VAR-202208-2051 CVE-2022-31773 IBM  of  IBM DataPower Gateway  Cross-site request forgery vulnerability in CVSS V2: -
CVSS V3: 8.8
Severity: HIGH
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 228357. (DoS) It may be in a state. IBM DataPower Gateway is a security and integration platform specially designed for mobile, cloud, application programming interface (API), network, service-oriented architecture (SOA), B2B and cloud workloads. The platform secures, integrates and optimizes access across channels with a dedicated gateway platform. The vulnerability stems from the fact that the WEB application does not fully verify whether the request is from a trusted user. Attackers can exploit this vulnerability to forge malicious requests to trick victims into clicking to perform sensitive operations
VAR-202208-1982 CVE-2022-36456 TOTOLINK  of  A720R  in the firmware  OS  Command injection vulnerability CVSS V2: 6.8
CVSS V3: 7.8
Severity: HIGH
TOTOLink A720R V4.1.5cu.532_B20210610 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi. TOTOLINK of A720R The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The TOTOLINK A720R is a wireless router launched by TOTOLINK, a Chinese electronics company. It features dual-band Wi-Fi and emphasizes high-speed network and signal coverage. Detailed vulnerability information is not currently available
VAR-202208-2029 CVE-2022-37076 TOTOLINK  of  a7000r  in the firmware  OS  Command injection vulnerability CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile. TOTOLINK of a7000r The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-1986 CVE-2022-37079 TOTOLINK  of  a7000r  in the firmware  OS  Command injection vulnerability CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg. TOTOLINK of a7000r The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202208-1970 CVE-2022-37823 Shenzhen Tenda Technology Co.,Ltd.  of  ax1803  Out-of-bounds write vulnerability in firmware CVSS V2: 7.2
CVSS V3: 7.8
Severity: HIGH
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function formSetVirtualSer. Shenzhen Tenda Technology Co.,Ltd. of ax1803 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. An attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system, or cause a denial of service
VAR-202208-1903 CVE-2022-37808 Shenzhen Tenda Technology Co.,Ltd.  of  ac1206  Out-of-bounds write vulnerability in firmware CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the index parameter in the function formWifiWpsOOB. Shenzhen Tenda Technology Co.,Ltd. of ac1206 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda AC1206 is a wireless through-the-wall Gigabit router produced by China Tenda. An attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system
VAR-202208-2030 CVE-2022-37809 Shenzhen Tenda Technology Co.,Ltd.  of  ac1206  Out-of-bounds write vulnerability in firmware CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the speed_dir parameter in the function formSetSpeedWan. Shenzhen Tenda Technology Co.,Ltd. of ac1206 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda AC1206 is a wireless through-the-wall Gigabit router produced by China Tenda. An attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system
VAR-202208-1902 CVE-2022-37800 Shenzhen Tenda Technology Co.,Ltd.  of  ac1206  Out-of-bounds write vulnerability in firmware CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function fromSetRouteStatic. Shenzhen Tenda Technology Co.,Ltd. of ac1206 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda AC1206 is a wireless through-the-wall Gigabit router produced by China Tenda. An attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system