Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-202202-1477 CVE-2022-22321 IBM MQ Appliance  Vulnerability regarding insufficient protection of authentication information in CVSS V2: 2.1
CVSS V3: 5.5
Severity: MEDIUM
IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. IBM X-Force ID: 218368. Vendors may IBM X-Force ID: 218368 It is published as.Information may be obtained. IBM MQ Appliance is an all-in-one appliance for rapidly deploying enterprise-class messaging middleware
VAR-202202-0768 CVE-2022-25062 TP-LINK TL-WR840N  Integer overflow vulnerability in CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. TP-LINK TL-WR840N(ES) Exists in an integer overflow vulnerability.Service operation interruption (DoS) It may be in a state. Tp-link TL-WR840N is a wireless router from China Tp-link company
VAR-202202-1526 CVE-2021-37103 EMUI  and  Magic UI  Vulnerability regarding improper default permissions in CVSS V2: 2.1
CVSS V3: 5.5
Severity: MEDIUM
There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality. EMUI and Magic UI There is a vulnerability in improper default permissions.Information may be obtained
VAR-202202-1522 CVE-2021-22437 EMUI  and  Magic UI  Integer overflow vulnerability in CVSS V2: 6.9
CVSS V3: 7.0
Severity: HIGH
There is a software integer overflow leading to a TOCTOU condition in smartphones. Successful exploitation of this vulnerability may cause random address access. EMUI and Magic UI includes an integer overflow vulnerability, and Time-of-check Time-of-use (TOCTOU) There is a race condition vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202202-0767 CVE-2021-22448 EMUI  and  Magic UI  Vulnerability in CVSS V2: 6.4
CVSS V3: 9.1
Severity: CRITICAL
There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause unauthorized read and write of some files. EMUI and Magic UI Exists in unspecified vulnerabilities.Information may be obtained and information may be tampered with
VAR-202202-1525 CVE-2021-37027 HUAWEI EMUI  and  Magic UI  Vulnerability in CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service integrity. HUAWEI EMUI and Magic UI Exists in unspecified vulnerabilities.Service operation interruption (DoS) It may be in a state
VAR-202202-1521 CVE-2022-25064 TP-LINK TL-WR840N  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr. TP-LINK TL-WR840N(ES) Contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tp-link TL-WR840N is a wireless router from China Tp-link company. No detailed vulnerability details are currently provided
VAR-202202-1531 CVE-2022-25061 Tp-link TL-WR840N Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute. TP-LINK TL-WR840N Contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tp-link TL-WR840N is a wireless router from China Tp-link company. There is a security vulnerability in TP-LINK TL-WR840N(ES) V6.20 180709. No detailed vulnerability details are currently available
VAR-202202-1530 CVE-2022-25060 TP-LINK TL-WR840N  Command injection vulnerability in CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing. TP-LINK TL-WR840N Contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tp-link TL-WR840N is a wireless router from China Tp-link company. There is a security vulnerability in TP-LINK TL-WR840N(ES) V6.20 180709. No detailed vulnerability details are currently available
VAR-202202-1229 CVE-2022-25081 TOTOLink T10 Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. TOTOLINK of t10 v2 Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLink T10 is a wireless network system router from China TotoLink Company
VAR-202202-0828 CVE-2022-24610 alecto  of  dvc-215ip  Insufficient Credential Protection Vulnerability in Firmware CVSS V2: 5.0
CVSS V3: 8.6
Severity: HIGH
Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera. alecto of dvc-215ip A firmware vulnerability related to insufficient protection of credentials exists.Information may be obtained. Alecto DVC-215IP is a camera from Alecto. An information disclosure vulnerability exists in Alecto DVC-215IP 63.1.1.173 and earlier
VAR-202202-1228 CVE-2022-25084 TOTOLINK  of  t6  Command injection vulnerability in firmware CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. (DoS) It may be in a state. TOTOLink T6 is a wireless dual-band router from China TotoLink Company
VAR-202202-1564 CVE-2022-25079 TOTOLink A810R Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. TOTOLINK of a810r Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLink A810R is a wireless dual-band router from China TotoLink Company
VAR-202202-1572 CVE-2022-25082 TOTOLink A950RG Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. TOTOLINK of a950rg Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLink A950RG is a wireless router from China TotoLink Company
VAR-202202-1589 CVE-2022-25417 Tenda AC9  Out-of-bounds write vulnerability in CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the function saveparentcontrolinfo. Tenda AC9 Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202202-0834 CVE-2022-25083 TOTOLINK  of  a860r  Command injection vulnerability in firmware CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. TOTOLINK of a860r Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLink A860R is a wireless router from China TotoLink Company
VAR-202202-0833 CVE-2022-25073 TP-LINK Technologies  of  TL-WR841N  Out-of-bounds write vulnerability in firmware CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr(). This vulnerability allows unauthenticated attackers to execute arbitrary code. TP-LINK Technologies of TL-WR841N An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tp-link TL-WR841N is a wireless router from China Tp-link company. A buffer overflow vulnerability exists in the Tp-link TL-WR841N router
VAR-202202-1581 CVE-2022-25078 TOTOLink A3600R Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. TOTOLINK of a3600r Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLink A3600R is a wireless router from China TotoLink Company
VAR-202202-0217 CVE-2022-25170 FATEK Automation FvDesigner Buffer Overflow Vulnerability (CNVD-2022-21229) CVSS V2: 6.8
CVSS V3: 7.8
Severity: HIGH
The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code. FATEK Automation FvDesigner is a human-computer interaction device of FATEK
VAR-202202-1579 CVE-2022-25072 TP-LINK Technologies  of  archer a54  Out-of-bounds write vulnerability in firmware CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
TP-Link Archer A54 Archer A54(US)_V1_210111 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthenticated attackers to execute arbitrary code. TP-LINK Technologies of archer a54 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tp-Link Archer A54 is a wireless dual-band router from Pulian Technology Co., Ltd. A buffer overflow vulnerability exists in the Archer A54 router of Pulian Technology Co., Ltd