Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-202202-0350 CVE-2021-46226 D-Link Di-7200G Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wget_test.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter. (DoS) It may be in a state. The D-Link Di-7200G is a gigabit enterprise-class router from China's D-Link company
VAR-202202-0686 CVE-2021-45736 TOTOLINK X5000R  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setL2tpServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the eip, sip, server parameters. TOTOLINK X5000R Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. TOTOLINK X5000R is a router
VAR-202202-1466 CVE-2021-45733 Totolink X5000R Command Injection Vulnerability CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the parameter host_time. TOTOLINK X5000R Contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The Totolink X5000R is a router from the Chinese company Totolink
VAR-202202-1241 CVE-2022-24145 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formWifiBasicSet. This vulnerability allows attackers to cause a Denial of Service (DoS) via the security and security_5g parameters. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0685 CVE-2021-45735 TOTOLINK X5000R  Vulnerability in plaintext transmission of important information in CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via packet capture software. TOTOLINK X5000R Contains a vulnerability in the transmission of important information in clear text.Information may be obtained
VAR-202202-0295 CVE-2022-22724 plural  Modicon M340  Product resource exhaustion vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 (All Versions). plural Modicon M340 The product contains a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state. The Schneider Electric Modicon M340 is a mid-range PLC (Programmable Logic Controller) from Schneider Electric in France for industrial processes and infrastructure
VAR-202202-0687 CVE-2021-45734 TOTOLINK X5000R  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via the url parameter. TOTOLINK X5000R Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state
VAR-202202-0650 CVE-2021-22284 ABB  Made  OPC Server for AC 800M  Code Execution Vulnerability with Unnecessary Privileges CVSS V2: 6.5
CVSS V3: 8.8
Severity: HIGH
Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running the AC800M OPC Server. ABB Provided by OPC Server for AC 800M Is a run-time data reader
VAR-202202-0708 CVE-2022-24158 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetIpMacBind. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0692 CVE-2022-24169 Tenda  router  G1  and  G3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindAdd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IPMacBindRule parameter
VAR-202202-0691 CVE-2022-24171 Tenda  router  G1  and  G3  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters. (DoS) It may be in a state
VAR-202202-1467 CVE-2022-24167 Tenda  router  G1  and  G3  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter. (DoS) It may be in a state
VAR-202202-1491 CVE-2022-24153 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formAddMacfilterRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the devName parameter. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0717 CVE-2022-24156 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetVirtualSer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0693 CVE-2022-24166 Tenda  router  G1  and  G3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the manualTime parameter
VAR-202202-1250 CVE-2022-24168 Tenda  router  G1  and  G3  Command injection vulnerability in CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP parameters. (DoS) It may be in a state
VAR-202202-1248 CVE-2022-24172 Tenda  router  G1  and  G3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the addDhcpRules parameter
VAR-202202-0736 CVE-2022-24154 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetRebootTimer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the rebootTime parameter. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-0703 CVE-2022-24160 Tenda AX3  Out-of-bounds write vulnerability in CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetDeviceName. This vulnerability allows attackers to cause a Denial of Service (DoS) via the devName parameter. Tenda AX3 Exists in an out-of-bounds write vulnerability.Service operation interruption (DoS) It may be in a state. Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda, China
VAR-202202-1249 CVE-2022-24170 Tenda G1 and G3 Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet parameters. (DoS) It may be in a state