Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-202202-1235 CVE-2021-45994 Tenda  router  G1  and  G3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formDelDhcpRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the delDhcpIndex parameter
VAR-202202-0344 CVE-2021-46230 D-Link  device  DI-7200GV2.E1  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgrade_filter. This vulnerability allows attackers to execute arbitrary commands via the path and time parameters. (DoS) It may be in a state. The D-Link Di-7200G is a gigabit enterprise-class router from China's D-Link company
VAR-202202-0684 CVE-2021-45738 TOTOLINK X5000  Command injection vulnerability in CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName. TOTOLINK X5000 Contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK X5000R is a router
VAR-202202-0689 CVE-2021-44246 plural  Totolink  Out-of-bounds write vulnerabilities in devices CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain a stack overflow in the function setNoticeCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IpTo parameter. Totolink device A3100R , A830R , A720R Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. TOTOLink A3100R is a wireless router. TOTOLink A830R is a wireless dual-band router. TOTOLink A720R is a wireless router
VAR-202202-0681 CVE-2021-45742 Totolink A720R Command Injection Vulnerability CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. TOTOLINK A720R Contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A720R is a router device
VAR-202202-1245 CVE-2022-24152 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetRouteStatic. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0340 CVE-2021-46456 D-Link  device  DIR-823-Pro  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allows attackers to execute arbitrary commands via the wl(0).(0)_maclist parameter. (DoS) It may be in a state. D-Link Dir-823-Pro is a dual-band smart wireless router from China D-Link company
VAR-202202-1236 CVE-2021-45995 Tenda  router  G1  and  G3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetStaticRoute. This vulnerability allows attackers to cause a Denial of Service (DoS) via the staticRouteNet, staticRouteMask, and staticRouteGateway parameters
VAR-202202-0347 CVE-2021-46232 D-Link  device  DI-7200GV2.E1  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function version_upgrade.asp. This vulnerability allows attackers to execute arbitrary commands via the path parameter. (DoS) It may be in a state. The D-Link Di-7200G is a gigabit enterprise-class router from China's D-Link company
VAR-202202-1465 CVE-2021-45737 TOTOLINK A720R  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the Host parameter. TOTOLINK A720R Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. TOTOLINK A720R is a wireless router
VAR-202202-0335 CVE-2021-46457 D-Link  device  DIR-823-Pro  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function ChgSambaUserSettings. This vulnerability allows attackers to execute arbitrary commands via the samba_name parameter. (DoS) It may be in a state. D-Link Dir-823-Pro is a dual-band smart wireless router from China D-Link company
VAR-202202-0685 CVE-2021-45735 TOTOLINK X5000R  Vulnerability in plaintext transmission of important information in CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via packet capture software. TOTOLINK X5000R Contains a vulnerability in the transmission of important information in clear text.Information may be obtained
VAR-202202-1224 CVE-2021-45739 TOTOLINK A720R  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the flag parameter. TOTOLINK A720R Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. TOTOLINK A720R is a wireless router
VAR-202202-0345 CVE-2021-46227 D-Link  device  DI-7200GV2.E1  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function proxy_client.asp. This vulnerability allows attackers to execute arbitrary commands via the proxy_srv, proxy_srvport, proxy_lanip, proxy_lanport parameters. (DoS) It may be in a state. The D-Link Di-7200G is a gigabit enterprise-class router from D-Link, a company in China
VAR-202202-0678 CVE-2021-45993 Tenda  router  G1  and  G3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindModify. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IPMacBindRuleIP and IPMacBindRuleMac parameters
VAR-202202-0654 CVE-2021-21965 Sealevel Systems, Inc. SeaConnect 370W  Authentication vulnerability in CVSS V2: 6.4
CVSS V3: 9.3
Severity: CRITICAL
A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability. Sealevel Systems, Inc. SeaConnect 370W There is an authentication vulnerability in.Information is tampered with and service operation is interrupted (DoS) It may be in a state. Used to remotely monitor and control the status of the actual I/O process
VAR-202202-1241 CVE-2022-24145 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formWifiBasicSet. This vulnerability allows attackers to cause a Denial of Service (DoS) via the security and security_5g parameters. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0336 CVE-2021-46454 D-Link  device  DIR-823-Pro  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanApcliSettings. This vulnerability allows attackers to execute arbitrary commands via the ApCliKeyStr parameter. (DoS) It may be in a state. D-Link Dir-823-Pro is a dual-band smart wireless router from China D-Link company
VAR-202202-0652 CVE-2021-21969 Sealevel Systems, Inc. SeaConnect 370W  Out-of-bounds write vulnerability in CVSS V2: 6.8
CVSS V3: 8.1
Severity: HIGH
An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSeaCloudMessage function uses at [4] the json_object_get_string to populate the p_payload global variable. The p_payload is only 0x100 bytes long, and the total MQTT message could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s value and not the actual str size, this would result in a possible out-of-bounds write. Sealevel Systems, Inc. SeaConnect 370W Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Used to remotely monitor and control the status of the actual I/O process
VAR-202202-0360 CVE-2021-44881 D-Link  device  DIR_882  Command injection vulnerability in CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request. (DoS) It may be in a state. D-Link DIR-882 is a wireless router from D-Link Company in Taiwan