Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-202202-0674 CVE-2022-24149 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWirelessRepeat. This vulnerability allows attackers to cause a Denial of Service (DoS) via the wpapsk_crypto parameter. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0680 CVE-2021-45986 Tenda  router  G1  and  G3  In  OS  Command injection vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetUSBShareInfo. This vulnerability allows attackers to execute arbitrary commands via the usbOrdinaryUserName parameter. (DoS) It may be in a state
VAR-202202-1245 CVE-2022-24152 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetRouteStatic. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-1243 CVE-2022-24148 Tenda AX3  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function mDMZSetCfg. This vulnerability allows attackers to execute arbitrary commands via the dmzIp parameter. (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0675 CVE-2022-24147 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromAdvSetMacMtuWan. This vulnerability allows attackers to cause a Denial of Service (DoS) via the wanMTU, wanSpeed, cloneType, mac, and serviceName parameters. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0673 CVE-2022-24150 Tenda AX3  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function formSetSafeWanWebMan. This vulnerability allows attackers to execute arbitrary commands via the remoteIp parameter. (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-1242 CVE-2022-24146 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetQosBand. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0685 CVE-2021-45735 TOTOLINK X5000R  Vulnerability in plaintext transmission of important information in CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via packet capture software. TOTOLINK X5000R Contains a vulnerability in the transmission of important information in clear text.Information may be obtained
VAR-202202-1236 CVE-2021-45995 Tenda  router  G1  and  G3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetStaticRoute. This vulnerability allows attackers to cause a Denial of Service (DoS) via the staticRouteNet, staticRouteMask, and staticRouteGateway parameters
VAR-202202-1234 CVE-2021-45992 Tenda  router  G1  and  G3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetQvlanList. This vulnerability allows attackers to cause a Denial of Service (DoS) via the qvlanName parameter
VAR-202202-0682 CVE-2021-45740 TOTOLINK A720R  Out-of-bounds write vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the setWiFiWpsStart function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the pin parameter. TOTOLINK A720R Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A720R is a router device. A buffer overflow vulnerability exists in TOTOLINK A720R setWiFiWpsStart, which can be exploited by a remote attacker to submit a special request, execute arbitrary code in the application context or crash the application
VAR-202202-0295 CVE-2022-22724 plural  Modicon M340  Product resource exhaustion vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 (All Versions). plural Modicon M340 The product contains a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state. The Schneider Electric Modicon M340 is a mid-range PLC (Programmable Logic Controller) from Schneider Electric in France for industrial processes and infrastructure
VAR-202202-0347 CVE-2021-46232 D-Link  device  DI-7200GV2.E1  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function version_upgrade.asp. This vulnerability allows attackers to execute arbitrary commands via the path parameter. (DoS) It may be in a state. The D-Link Di-7200G is a gigabit enterprise-class router from China's D-Link company
VAR-202202-0346 CVE-2021-46231 D-Link  device  DI-7200GV2.E1  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function urlrd_opt.asp. This vulnerability allows attackers to execute arbitrary commands via the url_en parameter. (DoS) It may be in a state. The D-Link Di-7200G is a gigabit enterprise-class router from China's D-Link company
VAR-202202-0350 CVE-2021-46226 D-Link Di-7200G Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wget_test.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter. (DoS) It may be in a state. The D-Link Di-7200G is a gigabit enterprise-class router from China's D-Link company
VAR-202202-1465 CVE-2021-45737 TOTOLINK A720R  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the Host parameter. TOTOLINK A720R Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. TOTOLINK A720R is a wireless router
VAR-202202-0335 CVE-2021-46457 D-Link  device  DIR-823-Pro  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function ChgSambaUserSettings. This vulnerability allows attackers to execute arbitrary commands via the samba_name parameter. (DoS) It may be in a state. D-Link Dir-823-Pro is a dual-band smart wireless router from China D-Link company
VAR-202202-1241 CVE-2022-24145 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formWifiBasicSet. This vulnerability allows attackers to cause a Denial of Service (DoS) via the security and security_5g parameters. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0679 CVE-2021-45988 Tenda  router  G1  and  G3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDnsForward. This vulnerability allows attackers to cause a Denial of Service (DoS) via the DnsForwardRule parameter
VAR-202202-0338 CVE-2021-46452 D-Link Dir-823-Pro Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via the tomography_ping_address, tomography_ping_number, tomography_ping_size, tomography_ping_timeout, and tomography_ping_ttl parameters. (DoS) It may be in a state. D-Link Dir-823-Pro is a dual-band smart wireless router from China D-Link company