VARIoT IoT vulnerabilities database

In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies. TOTOLINK of A3100R Firmware has a lack of authentication vulnerability for critical functionality.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TotoLink A3100R is a series of wireless routers from TotoLink, a Taiwanese company. TotoLink A3100R V5.9c.4577 version has an access control error vulnerability

totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption. TOTOLINK of ex300 v2 firmware and A720R A vulnerability exists in the firmware regarding resource allocation without limits or throttling.Service operation interruption (DoS) It may be in a state. TotoLink EX300 is a 300 Mbps wireless N range extender from TotoLink in China. TotoLink A720R is a gigabit dual-band wireless wifi amplifier from China TotoLink company. TotoLink EX300_v2 and A720R have a resource management error vulnerability that could be exploited by an attacker to run out of storage space, resulting in a DoS condition

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page. firmware analysis and comparison tool project Contains a cross-site request forgery vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability stems from the fact that the WEB application does not fully verify whether the request is from a trusted user. An attacker could exploit this vulnerability to forge a malicious request to log in to an administrator to click to perform sensitive operations

Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations. TOTOLINK of A3100R A vulnerability exists in the firmware regarding the use of insufficient random values.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TotoLink A3100R is a series of wireless routers from TotoLink, a Taiwanese company

totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks. TOTOLINK of ar3100r The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TotoLink A3100R is a series of wireless routers from TotoLink, a Taiwanese company. The vulnerability is caused by the input field not being properly filtered

totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check. TOTOLINK of ex300 v2 Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TotoLink EX300 is a 300 Mbps wireless N range extender from TotoLink in China

totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism. TOTOLINK of ex300 v2 firmware and ex1200t Firmware has a lack of authentication vulnerability for critical functionality.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK EX300 is a 300 Mbps wireless N range extender from China TotoLink company, TOTOLINK EX1200T is a Wi-Fi range extender from China TOTOLINK company. An access control error vulnerability exists in TOTOLINK EX300_v2 and EX1200T. The vulnerability stems from the device web server not performing any authentication, allowing an attacker to access the web ui and perform any actions

totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp. TOTOLINK of ex300 v2 Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. TotoLink EX300 is a 300 Mbps wireless N range extender from China TotoLink Company

Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to run arbitrary code on the affected device. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32. (DoS) It may be in a state

Arista Networks is one of the leading manufacturers of networking equipment for large data centers, high performance computing systems and cloud networking solutions. Arista VEOS has a binary vulnerability that could be exploited by an attacker to cause a denial of service attack.

Arista Networks is one of the leading manufacturers of networking equipment for large data centers, high performance computing systems and cloud networking solutions. Arista VEOS has a binary vulnerability that can be exploited by an attacker to cause a denial of service attack.

Arista Networks is one of the leading manufacturers of networking equipment for large data centers, high performance computing systems and cloud networking solutions. Arista VEOS has a binary vulnerability that can be exploited by an attacker to cause a denial of service attack.

Arista Networks is one of the leading manufacturers of networking equipment for large data centers, high performance computing systems and cloud networking solutions. Arista VEOS has a binary vulnerability that could be exploited by an attacker to cause a denial of service attack.

Arista Networks is one of the leading manufacturers of networking equipment for large data centers, high performance computing systems and cloud networking solutions. Arista VEOS has a binary vulnerability that could be exploited by an attacker to cause a denial of service attack.

Arista Networks is one of the leading manufacturers of networking equipment for large data centers, high performance computing systems and cloud networking solutions. Arista VEOS has a binary vulnerability that can be exploited by an attacker to cause a denial of service attack.

Arista Networks is one of the leading manufacturers of networking equipment for large data centers, high performance computing systems and cloud networking solutions. Arista VEOS has a binary vulnerability that could be exploited by an attacker to cause a denial of service attack.

Arista Networks is one of the leading manufacturers of networking equipment for large data centers, high performance computing systems and cloud networking solutions. Arista VEOS has a binary vulnerability that could be exploited by an attacker to cause a denial of service attack.

There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters and trigger an XSS attack when the user views the current topology of the device through the management page. ZTE of zxhn f680 Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. This vulnerability is caused by the lack of data verification filtering for user-provided data and output in the gateway name

A specially crafted TCP/IP packet may cause the camera recovery image web interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware. autodome ip 4000i firmware, autodome ip 5000i firmware, autodome ip starlight 5000i firmware etc. Robert Bosch GmbH The product contains a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware. autodome ip 4000i firmware, autodome ip 5000i firmware, autodome ip starlight 5000i firmware etc. Robert Bosch GmbH The product contains a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state