VARIoT IoT vulnerabilities database
| VAR-202104-0778 | CVE-2021-21730 | ZTE ZXHN H168N Security hole |
CVSS V2: 5.0 CVSS V3: 9.8 Severity: CRITICAL |
A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This affects: ZXHN H168N V3.5.0_TY.T6
| VAR-202104-1029 | CVE-2021-27603 | SAP NetWeaver AS ABAP Vulnerability in |
CVSS V2: 4.0 CVSS V3: 6.5 Severity: Medium |
An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system. SAP NetWeaver AS ABAP Contains an unspecified vulnerability.Denial of service (DoS) It may be put into a state
| VAR-202104-1554 | CVE-2021-23278 | Eaton Intelligent Power Manager arbitrary file deletion vulnerability (CNVD-2021-31672) |
CVSS V2: 5.5 CVSS V3: 9.6 Severity: CRITICAL |
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action removeFirmware. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed. Eaton Intelligent Power Manager (IPM) is an intelligent power manager from Eaton, USA. It supports remote monitoring and management of multiple devices in the network from the interface. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202104-1556 | CVE-2021-23280 | Eaton Intelligent Power Manager arbitrary file upload vulnerability |
CVSS V2: 6.5 CVSS V3: 9.9 Severity: CRITICAL |
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability. It supports remote monitoring and management of multiple devices in the network from the interface. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202105-0617 | CVE-2021-1499 | Cisco HyperFlex HX Data Platform Access Control Error Vulnerability |
CVSS V2: 5.0 CVSS V3: 5.3 Severity: MEDIUM |
A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is due to missing authentication for the upload function. An attacker could exploit this vulnerability by sending a specific HTTP request to an affected device. A successful exploit could allow the attacker to upload files to the affected device with the permissions of the tomcat8 user. Cisco HyperFlex HX Data Platform is a network device of Cisco (Cisco) in the United States. Provide enterprise-level agility, scalability, security and life cycle management functions. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202105-1385 | CVE-2021-32458 | Trend Micro Home Network Security Out-of-bounds Vulnerability in Microsoft |
CVSS V2: 7.2 CVSS V3: 7.8 Severity: HIGH |
Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which could allow an attacker to issue a specially crafted iotcl which could lead to code execution on affected devices. An attacker must first obtain the ability to execute low-privileged code on the target device in order to exploit this vulnerability. Used to scan all incoming and outgoing home network traffic to prevent intrusions, prevent hacker attacks and network threats, and protect privacy. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202105-0509 | CVE-2021-1554 | Cisco Small Business Series Wireless Access Points Command injection vulnerability |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device. Cisco Small Business is a switch of the US Cisco (Cisco) company.
Cisco Small Business has an input validation error vulnerability, which is caused by a validation error provided to the user. Attackers can use this vulnerability to execute command injections for attacks on affected devices. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202106-1411 | CVE-2021-23854 | Bosch IP cameras cross-site scripting vulnerability |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected. Bosch IP There is a cross-site scripting vulnerability in the camera.Information may be obtained and information may be tampered with. Bosch IP cameras are German (Bosch) network cameras. No detailed vulnerability details are currently provided. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202104-1828 | CVE-2021-27393 | Siemens Nucleus product DNS module can predict UDP port number vulnerability |
CVSS V2: 5.0 CVSS V3: 5.3 Severity: MEDIUM |
A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nucleus Source Code (Versions including affected DNS modules). The DNS client does not properly randomize UDP port numbers of DNS requests. That could allow an attacker to poison the DNS cache or spoof DNS resolving. The Nucleus NET module contains a series of standard-compliant network and communication protocols, drivers and utilities to provide full-featured network support in any embedded device. Nucleus RTOS provides a highly scalable microkernel-based real-time operating system designed for the scalability and reliability of systems in aerospace, industrial and medical applications. VSTAR is a complete AUTOSAR 4 based ECU solution that provides tools and embedded software for timely product deployment. Nucleus ReadyStart is a platform with integrated software IP, tools and services.
The DNS module of Siemens Nucleus products has security vulnerabilities. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202104-1557 | CVE-2021-23281 | Eaton Intelligent Power Manager remote code execution vulnerability |
CVSS V2: 7.5 CVSS V3: 10.0 Severity: CRITICAL |
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to rouge SNMP server and execute attacker-controlled code. It supports remote monitoring and management of multiple devices in the network from the interface. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202104-1549 | CVE-2021-3460 | Motorola MH702 trust management issue vulnerability |
CVSS V2: 7.5 CVSS V3: 9.8 Severity: CRITICAL |
The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker. Motorola MH702 is a router of Motorola (Motorola), USA.
Motorola MH702x devices versions prior to 2.0.0.301 have a trust management issue vulnerability. Attackers can use the vulnerability to access the communication channel
| VAR-202105-0086 | CVE-2020-20222 | Mikrotik RouterOs In NULL Pointer dereference vulnerability |
CVSS V2: 4.0 CVSS V3: 6.5 Severity: MEDIUM |
Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. MikroTik RouterOS is a Linux-based router operating system developed by Latvian MikroTik Company. The system can be deployed in a PC so that it provides router functionality. MikroTik RouterOS has a code issue vulnerability. The following products and versions are affected: MikroTik RouterOS: 6.40, 6.40.1, 6.40.2, 6.40.3, 6.40.4, 6.40.5, 6.40.6, 6.40.7, 6.40.8, 6.40.9, 6.41, 6.41.1, 6.41.2, 6.41.3, 6.41.4, 6.42, 6.42.1, 6.42.2, 6.42.3, 6.42.4, 6.42.5, 6.42.6, 6.42.7, 6.42.9, 6.42.10, 6.42.11, 6.42.12, 6.43, 6.43.1, 6.43.2, 6.43.3, 6.43.4, 6.43.5, 6.43.6, 6.43.7, 6.43.8, 6.43.9, 6.43.10, 6.43.11, 6.43.12, 6.43.13, 6.43.14, 6.43.15, 6.43.16, 6.44, 6.44.1, 6.44.2, 6.44.3, 6.44.4, 6.44.5, 6.44.6, 6.45, 6.45.1, 6.45.2, 6.45.3, 6.45.4, 6.45.5, 6.45.6, 6.45.7, 6.45.8, 6.45.9, 6.46, 6.46.1, 6.46. Advisory: four vulnerabilities found in MikroTik's RouterOS
Details
=======
Product: MikroTik's RouterOS
Vendor URL: https://mikrotik.com/
Vendor Status: no fix yet
CVE: CVE-2020-20214, CVE-2020-20222, CVE-2020-20236, CVE-2020-20237
Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team
Product Description
==================
RouterOS is the operating system used on the MikroTik's devices, such as
switch, router and access point.
Description of vulnerabilities
==========================
These vulnerabilities were reported to the vendor almost one year ago. And
the vendor confirmed these vulnerabilities. However, there is still no fix
for them yet.
By the way, the three vulnerabilities in sniffer binary are different from
each one.
1. There is
a reachable assertion in the btest process. By sending a crafted packet, an
authenticated remote user can crash the btest process due to assertion
failure.
Against stable 6.46.5, the poc resulted in the following crash dump.
# cat /rw/logs/backtrace.log
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: /nova/bin/btest
2020.06.19-15:51:36.94@0: --- signal=6
--------------------------------------------
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: eip=0x7772255b eflags=0x00000246
2020.06.19-15:51:36.94@0: edi=0x00fe0001 esi=0x7772a200 ebp=0x7fdcf880
esp=0x7fdcf878
2020.06.19-15:51:36.94@0: eax=0x00000000 ebx=0x0000010f ecx=0x0000010f
edx=0x00000006
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: maps:
2020.06.19-15:51:36.94@0: 08048000-08057000 r-xp 00000000 00:0c 1006
/nova/bin/btest
2020.06.19-15:51:36.94@0: 776f4000-77729000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.19-15:51:36.94@0: 7772d000-77747000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.19-15:51:36.94@0: 77748000-77757000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.19-15:51:36.94@0: 77758000-77775000 r-xp 00000000 00:0c 947
/lib/libucrypto.so
2020.06.19-15:51:36.94@0: 77776000-777c2000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.19-15:51:36.94@0: 777c8000-777cf000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: stack: 0x7fdd0000 - 0x7fdcf878
2020.06.19-15:51:36.94@0: 00 a0 72 77 00 a0 72 77 b8 f8 dc 7f 77 e0 71
77 06 00 00 00 00 a2 72 77 20 00 00 00 00 00 00 00
2020.06.19-15:51:36.94@0: 16 00 00 00 18 f9 dc 7f b4 f8 dc 7f e4 2a 7c
77 01 00 00 00 e4 2a 7c 77 16 00 00 00 01 00 fe 00
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: code: 0x7772255b
2020.06.19-15:51:36.94@0: 5b 3d 00 f0 ff ff 76 0e 8b 93 cc ff ff ff f7
d8
This vulnerability was initially found in long-term 6.44.5, and it seems
that the latest stable version 6.48.2 still suffers from this vulnerability.
2.
Against stable 6.46.5, the poc resulted in the following crash dump.
# cat /rw/logs/backtrace.log
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0: /nova/bin/sniffer
2020.06.19-16:36:18.33@0: --- signal=11
--------------------------------------------
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0: eip=0x08050e33 eflags=0x00010206
2020.06.19-16:36:18.33@0: edi=0x08057a24 esi=0x7f85c094 ebp=0x7f85c0c8
esp=0x7f85c080
2020.06.19-16:36:18.33@0: eax=0x00000000 ebx=0x7f85c090 ecx=0x00ff0000
edx=0x08059678
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0: maps:
2020.06.19-16:36:18.33@0: 08048000-08056000 r-xp 00000000 00:0c 1034
/nova/bin/sniffer
2020.06.19-16:36:18.33@0: 776ce000-77703000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.19-16:36:18.33@0: 77707000-77721000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.19-16:36:18.33@0: 77722000-77731000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.19-16:36:18.33@0: 77732000-7773a000 r-xp 00000000 00:0c 950
/lib/libubox.so
2020.06.19-16:36:18.33@0: 7773b000-77787000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.19-16:36:18.33@0: 7778d000-77794000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0: stack: 0x7f85d000 - 0x7f85c080
2020.06.19-16:36:18.33@0: 2c 08 07 08 04 00 fe 08 fe 00 00 00 20 ad 05
08 00 0c 07 08 a0 0b 07 08 af 0b 07 08 04 7a 05 08
2020.06.19-16:36:18.33@0: 08 00 00 00 24 7a 05 08 ff 00 00 00 00 00 00
00 08 c2 85 7f e4 7a 78 77 d8 c0 85 7f e4 7a 78 77
2020.06.19-16:36:18.34@0:
2020.06.19-16:36:18.34@0: code: 0x8050e33
2020.06.19-16:36:18.34@0: 0b 48 0c 89 fa 89 d8 e8 7d f1 ff ff 50 50 53
56
This vulnerability was initially found in long-term 6.44.6, and it seems
that the latest stable version 6.48.2 still suffers from this vulnerability.
3. By
sending a crafted packet, an authenticated remote user can crash the
sniffer process due to invalid memory access.
Against stable 6.46.5, the poc resulted in the following crash dump.
# cat /rw/logs/backtrace.log
2020.06.19-16:58:33.42@0:
2020.06.19-16:58:33.42@0:
2020.06.19-16:58:33.42@0: /nova/bin/sniffer
2020.06.19-16:58:33.42@0: --- signal=11
--------------------------------------------
2020.06.19-16:58:33.42@0:
2020.06.19-16:58:33.42@0: eip=0x08050dac eflags=0x00010202
2020.06.19-16:58:33.42@0: edi=0x08057a24 esi=0x00000001 ebp=0x7f8df428
esp=0x7f8df3e0
2020.06.19-16:58:33.42@0: eax=0x08073714 ebx=0x08073710 ecx=0x08073704
edx=0x08073714
2020.06.19-16:58:33.42@0:
2020.06.19-16:58:33.42@0: maps:
2020.06.19-16:58:33.42@0: 08048000-08056000 r-xp 00000000 00:0c 1034
/nova/bin/sniffer
2020.06.19-16:58:33.42@0: 77730000-77765000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.19-16:58:33.42@0: 77769000-77783000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.19-16:58:33.42@0: 77784000-77793000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.19-16:58:33.42@0: 77794000-7779c000 r-xp 00000000 00:0c 950
/lib/libubox.so
2020.06.19-16:58:33.42@0: 7779d000-777e9000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.19-16:58:33.43@0: 777ef000-777f6000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.19-16:58:33.43@0:
2020.06.19-16:58:33.43@0: stack: 0x7f8e0000 - 0x7f8df3e0
2020.06.19-16:58:33.43@0: 3c ab 05 08 04 00 fe 08 e0 0f 00 00 14 37 07
08 24 7a 05 08 00 00 00 00 18 f4 8d 7f 04 7a 05 08
2020.06.19-16:58:33.43@0: 08 00 00 00 24 7a 05 08 04 00 00 00 00 00 00
00 70 4a 7a 77 e4 9a 7e 77 38 f4 8d 7f e4 9a 7e 77
2020.06.19-16:58:33.43@0:
2020.06.19-16:58:33.43@0: code: 0x8050dac
2020.06.19-16:58:33.43@0: 8b 43 04 83 e0 fc 85 c0 74 1c 8b 4b 14 39 34
08
This vulnerability was initially found in long-term 6.46.3, and it seems
that the latest version stable 6.48.2 still suffers from this vulnerability.
4. By
sending a crafted packet, an authenticated remote user can crash the
sniffer process due to invalid memory access.
Against stable 6.46.5, the poc resulted in the following crash dump.
# cat /rw/logs/backtrace.log
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: /nova/bin/sniffer
2020.06.19-17:58:43.98@0: --- signal=11
--------------------------------------------
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: eip=0x77712055 eflags=0x00010202
2020.06.19-17:58:43.98@0: edi=0x77720f34 esi=0x77721015 ebp=0x7ff96b38
esp=0x7ff96af8
2020.06.19-17:58:43.98@0: eax=0x77721054 ebx=0x7771f000 ecx=0x77721034
edx=0x77721014
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: maps:
2020.06.19-17:58:43.98@0: 08048000-08056000 r-xp 00000000 00:0c 1034
/nova/bin/sniffer
2020.06.19-17:58:43.98@0: 776e9000-7771e000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.19-17:58:43.98@0: 77722000-7773c000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.19-17:58:43.98@0: 7773d000-7774c000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.19-17:58:43.98@0: 7774d000-77755000 r-xp 00000000 00:0c 950
/lib/libubox.so
2020.06.19-17:58:43.98@0: 77756000-777a2000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.19-17:58:43.98@0: 777a8000-777af000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: stack: 0x7ff97000 - 0x7ff96af8
2020.06.19-17:58:43.98@0: 00 f0 71 77 00 0f 72 77 30 00 00 00 00 00 00
00 38 b2 05 08 34 0f 72 77 04 00 00 00 00 0f 72 77
2020.06.19-17:58:43.98@0: 20 00 00 00 1b 7b 71 77 e8 f1 71 77 98 00 00
00 01 00 00 00 ec c4 74 77 74 a1 05 08 f8 6b f9 7f
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: code: 0x77712055
2020.06.19-17:58:43.98@0: 89 14 10 eb bc 8b 93 a4 ff ff ff 8b 7d e0 8b
42
Interestingly, the same poc resulted in another different crash
dump(SIGABRT) against stable 6.48.2.
# cat /rw/logs/backtrace.log
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: /nova/bin/sniffer
2021.05.07-16:02:37.25@0: --- signal=6
--------------------------------------------
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: eip=0x776f255b eflags=0x00000246
2021.05.07-16:02:37.25@0: edi=0x0805aca8 esi=0x776fa200 ebp=0x7f97def8
esp=0x7f97def0
2021.05.07-16:02:37.25@0: eax=0x00000000 ebx=0x000000b6 ecx=0x000000b6
edx=0x00000006
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: maps:
2021.05.07-16:02:37.25@0: 08048000-08056000 r-xp 00000000 00:0c 1036
/nova/bin/sniffer
2021.05.07-16:02:37.25@0: 776c4000-776f9000 r-xp 00000000 00:0c 966
/lib/libuClibc-0.9.33.2.so
2021.05.07-16:02:37.25@0: 776fd000-77717000 r-xp 00000000 00:0c 962
/lib/libgcc_s.so.1
2021.05.07-16:02:37.25@0: 77718000-77727000 r-xp 00000000 00:0c 945
/lib/libuc++.so
2021.05.07-16:02:37.25@0: 77728000-77730000 r-xp 00000000 00:0c 951
/lib/libubox.so
2021.05.07-16:02:37.25@0: 77731000-7777d000 r-xp 00000000 00:0c 947
/lib/libumsg.so
2021.05.07-16:02:37.25@0: 77783000-7778a000 r-xp 00000000 00:0c 960
/lib/ld-uClibc-0.9.33.2.so
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: stack: 0x7f97f000 - 0x7f97def0
2021.05.07-16:02:37.25@0: 00 a0 6f 77 00 a0 6f 77 30 df 97 7f 77 e0 6e
77 06 00 00 00 00 a2 6f 77 20 00 00 00 00 00 00 00
2021.05.07-16:02:37.25@0: 26 2b 6f 77 00 a0 6f 77 28 df 97 7f 21 2c 6f
77 e8 a1 6f 77 00 a0 6f 77 00 bf 6f 77 a8 ac 05 08
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: code: 0x776f255b
2021.05.07-16:02:37.25@0: 5b 3d 00 f0 ff ff 76 0e 8b 93 cc ff ff ff f7
d8
This vulnerability was initially found in long-term 6.46.3, and it seems
that the latest stable version 6.48.2 suffers from an assertion failure
vulnerability when running the same poc.
Solution
========
No upgrade firmware available yet
References
==========
[1] https://mikrotik.com/download/changelogs/stable-release-tree
| VAR-202105-0089 | CVE-2020-20237 | Mikrotik RouterOs Buffer Error Vulnerability |
CVSS V2: 4.0 CVSS V3: 6.5 Severity: MEDIUM |
Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service due to improper memory access. Mikrotik RouterOs Is vulnerable to a buffer error.Denial of service (DoS) It may be put into a state. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. MikroTik RouterOS is a Linux-based router operating system developed by Latvian MikroTik Company. The system can be deployed in a PC so that it provides router functionality. MikroTik RouterOS has a buffer error vulnerability. The following products and versions are affected: MikroTik RouterOS: 6.46.3, 6.46.4, 6.46.5, 6.46.6, 6.46.7, 6.46.8, 6.47, 6.47.1, 6.47.2, 6.47.3, 6.47. Advisory: four vulnerabilities found in MikroTik's RouterOS
Details
=======
Product: MikroTik's RouterOS
Vendor URL: https://mikrotik.com/
Vendor Status: no fix yet
CVE: CVE-2020-20214, CVE-2020-20222, CVE-2020-20236, CVE-2020-20237
Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team
Product Description
==================
RouterOS is the operating system used on the MikroTik's devices, such as
switch, router and access point.
Description of vulnerabilities
==========================
These vulnerabilities were reported to the vendor almost one year ago. And
the vendor confirmed these vulnerabilities. However, there is still no fix
for them yet.
By the way, the three vulnerabilities in sniffer binary are different from
each one.
1. There is
a reachable assertion in the btest process. By sending a crafted packet, an
authenticated remote user can crash the btest process due to assertion
failure.
Against stable 6.46.5, the poc resulted in the following crash dump.
# cat /rw/logs/backtrace.log
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: /nova/bin/btest
2020.06.19-15:51:36.94@0: --- signal=6
--------------------------------------------
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: eip=0x7772255b eflags=0x00000246
2020.06.19-15:51:36.94@0: edi=0x00fe0001 esi=0x7772a200 ebp=0x7fdcf880
esp=0x7fdcf878
2020.06.19-15:51:36.94@0: eax=0x00000000 ebx=0x0000010f ecx=0x0000010f
edx=0x00000006
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: maps:
2020.06.19-15:51:36.94@0: 08048000-08057000 r-xp 00000000 00:0c 1006
/nova/bin/btest
2020.06.19-15:51:36.94@0: 776f4000-77729000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.19-15:51:36.94@0: 7772d000-77747000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.19-15:51:36.94@0: 77748000-77757000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.19-15:51:36.94@0: 77758000-77775000 r-xp 00000000 00:0c 947
/lib/libucrypto.so
2020.06.19-15:51:36.94@0: 77776000-777c2000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.19-15:51:36.94@0: 777c8000-777cf000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: stack: 0x7fdd0000 - 0x7fdcf878
2020.06.19-15:51:36.94@0: 00 a0 72 77 00 a0 72 77 b8 f8 dc 7f 77 e0 71
77 06 00 00 00 00 a2 72 77 20 00 00 00 00 00 00 00
2020.06.19-15:51:36.94@0: 16 00 00 00 18 f9 dc 7f b4 f8 dc 7f e4 2a 7c
77 01 00 00 00 e4 2a 7c 77 16 00 00 00 01 00 fe 00
2020.06.19-15:51:36.94@0:
2020.06.19-15:51:36.94@0: code: 0x7772255b
2020.06.19-15:51:36.94@0: 5b 3d 00 f0 ff ff 76 0e 8b 93 cc ff ff ff f7
d8
This vulnerability was initially found in long-term 6.44.5, and it seems
that the latest stable version 6.48.2 still suffers from this vulnerability.
2. By
sending a crafted packet, an authenticated remote user can crash the
sniffer process due to NULL pointer dereference.
Against stable 6.46.5, the poc resulted in the following crash dump.
# cat /rw/logs/backtrace.log
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0: /nova/bin/sniffer
2020.06.19-16:36:18.33@0: --- signal=11
--------------------------------------------
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0: eip=0x08050e33 eflags=0x00010206
2020.06.19-16:36:18.33@0: edi=0x08057a24 esi=0x7f85c094 ebp=0x7f85c0c8
esp=0x7f85c080
2020.06.19-16:36:18.33@0: eax=0x00000000 ebx=0x7f85c090 ecx=0x00ff0000
edx=0x08059678
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0: maps:
2020.06.19-16:36:18.33@0: 08048000-08056000 r-xp 00000000 00:0c 1034
/nova/bin/sniffer
2020.06.19-16:36:18.33@0: 776ce000-77703000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.19-16:36:18.33@0: 77707000-77721000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.19-16:36:18.33@0: 77722000-77731000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.19-16:36:18.33@0: 77732000-7773a000 r-xp 00000000 00:0c 950
/lib/libubox.so
2020.06.19-16:36:18.33@0: 7773b000-77787000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.19-16:36:18.33@0: 7778d000-77794000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.19-16:36:18.33@0:
2020.06.19-16:36:18.33@0: stack: 0x7f85d000 - 0x7f85c080
2020.06.19-16:36:18.33@0: 2c 08 07 08 04 00 fe 08 fe 00 00 00 20 ad 05
08 00 0c 07 08 a0 0b 07 08 af 0b 07 08 04 7a 05 08
2020.06.19-16:36:18.33@0: 08 00 00 00 24 7a 05 08 ff 00 00 00 00 00 00
00 08 c2 85 7f e4 7a 78 77 d8 c0 85 7f e4 7a 78 77
2020.06.19-16:36:18.34@0:
2020.06.19-16:36:18.34@0: code: 0x8050e33
2020.06.19-16:36:18.34@0: 0b 48 0c 89 fa 89 d8 e8 7d f1 ff ff 50 50 53
56
This vulnerability was initially found in long-term 6.44.6, and it seems
that the latest stable version 6.48.2 still suffers from this vulnerability.
3.
Against stable 6.46.5, the poc resulted in the following crash dump.
# cat /rw/logs/backtrace.log
2020.06.19-16:58:33.42@0:
2020.06.19-16:58:33.42@0:
2020.06.19-16:58:33.42@0: /nova/bin/sniffer
2020.06.19-16:58:33.42@0: --- signal=11
--------------------------------------------
2020.06.19-16:58:33.42@0:
2020.06.19-16:58:33.42@0: eip=0x08050dac eflags=0x00010202
2020.06.19-16:58:33.42@0: edi=0x08057a24 esi=0x00000001 ebp=0x7f8df428
esp=0x7f8df3e0
2020.06.19-16:58:33.42@0: eax=0x08073714 ebx=0x08073710 ecx=0x08073704
edx=0x08073714
2020.06.19-16:58:33.42@0:
2020.06.19-16:58:33.42@0: maps:
2020.06.19-16:58:33.42@0: 08048000-08056000 r-xp 00000000 00:0c 1034
/nova/bin/sniffer
2020.06.19-16:58:33.42@0: 77730000-77765000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.19-16:58:33.42@0: 77769000-77783000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.19-16:58:33.42@0: 77784000-77793000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.19-16:58:33.42@0: 77794000-7779c000 r-xp 00000000 00:0c 950
/lib/libubox.so
2020.06.19-16:58:33.42@0: 7779d000-777e9000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.19-16:58:33.43@0: 777ef000-777f6000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.19-16:58:33.43@0:
2020.06.19-16:58:33.43@0: stack: 0x7f8e0000 - 0x7f8df3e0
2020.06.19-16:58:33.43@0: 3c ab 05 08 04 00 fe 08 e0 0f 00 00 14 37 07
08 24 7a 05 08 00 00 00 00 18 f4 8d 7f 04 7a 05 08
2020.06.19-16:58:33.43@0: 08 00 00 00 24 7a 05 08 04 00 00 00 00 00 00
00 70 4a 7a 77 e4 9a 7e 77 38 f4 8d 7f e4 9a 7e 77
2020.06.19-16:58:33.43@0:
2020.06.19-16:58:33.43@0: code: 0x8050dac
2020.06.19-16:58:33.43@0: 8b 43 04 83 e0 fc 85 c0 74 1c 8b 4b 14 39 34
08
This vulnerability was initially found in long-term 6.46.3, and it seems
that the latest version stable 6.48.2 still suffers from this vulnerability.
4.
Against stable 6.46.5, the poc resulted in the following crash dump.
# cat /rw/logs/backtrace.log
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: /nova/bin/sniffer
2020.06.19-17:58:43.98@0: --- signal=11
--------------------------------------------
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: eip=0x77712055 eflags=0x00010202
2020.06.19-17:58:43.98@0: edi=0x77720f34 esi=0x77721015 ebp=0x7ff96b38
esp=0x7ff96af8
2020.06.19-17:58:43.98@0: eax=0x77721054 ebx=0x7771f000 ecx=0x77721034
edx=0x77721014
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: maps:
2020.06.19-17:58:43.98@0: 08048000-08056000 r-xp 00000000 00:0c 1034
/nova/bin/sniffer
2020.06.19-17:58:43.98@0: 776e9000-7771e000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.19-17:58:43.98@0: 77722000-7773c000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.19-17:58:43.98@0: 7773d000-7774c000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.19-17:58:43.98@0: 7774d000-77755000 r-xp 00000000 00:0c 950
/lib/libubox.so
2020.06.19-17:58:43.98@0: 77756000-777a2000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.19-17:58:43.98@0: 777a8000-777af000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: stack: 0x7ff97000 - 0x7ff96af8
2020.06.19-17:58:43.98@0: 00 f0 71 77 00 0f 72 77 30 00 00 00 00 00 00
00 38 b2 05 08 34 0f 72 77 04 00 00 00 00 0f 72 77
2020.06.19-17:58:43.98@0: 20 00 00 00 1b 7b 71 77 e8 f1 71 77 98 00 00
00 01 00 00 00 ec c4 74 77 74 a1 05 08 f8 6b f9 7f
2020.06.19-17:58:43.98@0:
2020.06.19-17:58:43.98@0: code: 0x77712055
2020.06.19-17:58:43.98@0: 89 14 10 eb bc 8b 93 a4 ff ff ff 8b 7d e0 8b
42
Interestingly, the same poc resulted in another different crash
dump(SIGABRT) against stable 6.48.2.
# cat /rw/logs/backtrace.log
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: /nova/bin/sniffer
2021.05.07-16:02:37.25@0: --- signal=6
--------------------------------------------
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: eip=0x776f255b eflags=0x00000246
2021.05.07-16:02:37.25@0: edi=0x0805aca8 esi=0x776fa200 ebp=0x7f97def8
esp=0x7f97def0
2021.05.07-16:02:37.25@0: eax=0x00000000 ebx=0x000000b6 ecx=0x000000b6
edx=0x00000006
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: maps:
2021.05.07-16:02:37.25@0: 08048000-08056000 r-xp 00000000 00:0c 1036
/nova/bin/sniffer
2021.05.07-16:02:37.25@0: 776c4000-776f9000 r-xp 00000000 00:0c 966
/lib/libuClibc-0.9.33.2.so
2021.05.07-16:02:37.25@0: 776fd000-77717000 r-xp 00000000 00:0c 962
/lib/libgcc_s.so.1
2021.05.07-16:02:37.25@0: 77718000-77727000 r-xp 00000000 00:0c 945
/lib/libuc++.so
2021.05.07-16:02:37.25@0: 77728000-77730000 r-xp 00000000 00:0c 951
/lib/libubox.so
2021.05.07-16:02:37.25@0: 77731000-7777d000 r-xp 00000000 00:0c 947
/lib/libumsg.so
2021.05.07-16:02:37.25@0: 77783000-7778a000 r-xp 00000000 00:0c 960
/lib/ld-uClibc-0.9.33.2.so
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: stack: 0x7f97f000 - 0x7f97def0
2021.05.07-16:02:37.25@0: 00 a0 6f 77 00 a0 6f 77 30 df 97 7f 77 e0 6e
77 06 00 00 00 00 a2 6f 77 20 00 00 00 00 00 00 00
2021.05.07-16:02:37.25@0: 26 2b 6f 77 00 a0 6f 77 28 df 97 7f 21 2c 6f
77 e8 a1 6f 77 00 a0 6f 77 00 bf 6f 77 a8 ac 05 08
2021.05.07-16:02:37.25@0:
2021.05.07-16:02:37.25@0: code: 0x776f255b
2021.05.07-16:02:37.25@0: 5b 3d 00 f0 ff ff 76 0e 8b 93 cc ff ff ff f7
d8
This vulnerability was initially found in long-term 6.46.3, and it seems
that the latest stable version 6.48.2 suffers from an assertion failure
vulnerability when running the same poc.
Solution
========
No upgrade firmware available yet
References
==========
[1] https://mikrotik.com/download/changelogs/stable-release-tree
| VAR-202105-0818 | CVE-2021-27737 | Apache Traffic Server Vulnerability in |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin. No detailed vulnerability details are currently provided. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202105-0507 | CVE-2021-1552 | Cisco Small Business Series Wireless Access Points Command injection vulnerability |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device. Cisco Small Business is a switch of the US Cisco (Cisco) company.
The Cisco Small Business product has an input verification error vulnerability, which is caused by a verification error provided to the user. Attackers can use this vulnerability to execute command injections for attacks on affected devices. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202105-0508 | CVE-2021-1553 | Cisco Small Business Series Wireless Access Points Command injection vulnerability |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device. Cisco Small Business is a switch of the US Cisco (Cisco) company.
Cisco Small Business has an input validation error vulnerability, which is caused by a validation error provided to the user. Attackers can use this vulnerability to execute command injections for attacks on affected devices. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202105-0754 | CVE-2021-32920 | Prosody Resource Depletion Vulnerability |
CVSS V2: 7.8 CVSS V3: 7.5 Severity: HIGH |
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. Prosody Is vulnerable to a resource exhaustion.Denial of service (DoS) It may be put into a state. Prosodical Thoughts Prosody is an open source application system of Prosodical Thoughts. A modern XMPP communication server.
There were security vulnerabilities before Prosody 0.11.9. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements.
For the stable distribution (buster), these problems have been fixed in
version 0.11.2-1+deb10u1.
We recommend that you upgrade your prosody packages.
For the detailed security status of prosody please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/prosody
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmCi0+8ACgkQEMKTtsN8
TjZnCg/+NZAMCpnKUqKs3vy7pZkXJXgCmCQgs3TYMXPGty3GuhjCO6Ao2sLnb0OE
Jh6QBpgUmGknhMEuU6wbscBK8oMUEkVvvrlFv1sjp8yHwqQ65KkZvnNNbOsVBFXB
Yy/aQzk8bYe601ZLXLR29IBVGPUA9+rjUXMqeBNok5LyEQW00yhe/WOOf8UqU7Ly
NteRRmc8aR3WL392EVChvKNtVftC+5n6CtegXwzD+OQYCWFEmKbo449ySQJDHHfY
oWvQBH9mk+lrfrRgIXqqZ9zFCEAg1cRaUQc0EBLkHFmRbHWCk/Ybk7mUm0dc3BFv
OdOHYR3+IHedOjhuBaDnbexffQaVpP8G8/av9Hpzu+SRbmlDVRNfzrtG6M3k3SGn
S9j7ah/uxsmuwYXQ4gjnYAhlpRDRkswpms22fZr4wEWRy17LgIIWQh1zIwii3s+U
M1uMhU56F0jjZ/X+SGhIdUIKhcKIv+vPbxlBM700T3VLDhpoWhd4+K6JZFcXhMeT
mIv12dghuHXwNp9ONw3kC946CLIMcerRqI1eB13f0XZw//+IcqBMPR6PzSkxqRdA
KxEOPLzipHNtnNTo/RevUyI1hbi1eWW0QT/sLtuhFSzQUtOW0EFf8ZxJFHBaADeu
vBvc9XewmRRGPpwXj42GaYZ/5c7VE3hiMEvdhFimSt666MnwhKg=
=miBj
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202105-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Low
Title: Prosŏdy IM: Multiple vulnerabilities
Date: May 26, 2021
Bugs: #771144, #789969
ID: 202105-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in Prosŏdy IM, the worst of
which could result in a Denial of Service condition. It aims to be easy to
set up and configure, and efficient with system resources.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-im/prosody < 0.11.9 >= 0.11.9
Description
===========
Multiple vulnerabilities have been discovered in Prosŏdy IM. Please
review the CVE identifiers referenced below for details.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Prosŏdy IM users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/prosody-0.11.9"
References
==========
[ 1 ] CVE-2021-32917
https://nvd.nist.gov/vuln/detail/CVE-2021-32917
[ 2 ] CVE-2021-32918
https://nvd.nist.gov/vuln/detail/CVE-2021-32918
[ 3 ] CVE-2021-32919
https://nvd.nist.gov/vuln/detail/CVE-2021-32919
[ 4 ] CVE-2021-32920
https://nvd.nist.gov/vuln/detail/CVE-2021-32920
[ 5 ] CVE-2021-32921
https://nvd.nist.gov/vuln/detail/CVE-2021-32921
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202105-15
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2021 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
| VAR-202105-0268 | CVE-2020-27185 | NPort IA5000A Vulnerability in plaintext transmission of critical information in series serial devices |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. Successfully exploiting the vulnerability could enable attackers to read authentication data, device configuration, and other sensitive data transmitted over Moxa Service. Moxa NPort IA5150A Series is a set of industrial equipment server. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202105-0267 | CVE-2020-27184 | NPort IA5000A Cryptographic strength vulnerabilities in series devices |
CVSS V2: 4.3 CVSS V3: 5.9 Severity: MEDIUM |
The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications, making it vulnerable to Man-in-the-Middle attacks. NPort IA5000A Cryptographic strength vulnerabilities exist in series devices.Information may be obtained. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
| VAR-202106-0816 | CVE-2021-20093 | Wibu-Systems CodeMeter Out-of-bounds read vulnerability in |
CVSS V2: 6.4 CVSS V3: 9.1 Severity: CRITICAL |
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server. Wibu-Systems CodeMeter Exists in an out-of-bounds read vulnerability.Information is obtained and service operation is interrupted (DoS) It may be in a state. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. CodeMeter is a security tool from WIBU in Germany, which provides integrated technology for software developers and smart device companies