VARIoT IoT vulnerabilities database

Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment. Endian Firewall Community ( alias EFW) Is vulnerable to the insertion or modification of arguments.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. There is a security vulnerability in the Endian Firewall Community. There is no information about this vulnerability at present. Please keep an eye on CNNVD or manufacturer announcements

TPEditor is a programming software used by Delta Electronics for a programmable display series under WINDOWS environment. Delta TPEditor TPE has a memory corruption vulnerability. Attackers can use this vulnerability to cause the program to crash.

Tianyi Kandian is a security service that integrates cameras, video, real-time monitoring, pan-tilt control, alarm, and storage, launched by China Power Hongxin Information Technology Co., Ltd., for companies, shops and other places that require visual management. Terminal management software and Internet service platform use computers and smart phones as media to realize remote control and help users better perform security and visual management. A weak password vulnerability exists in the cameras of China Telecom Tianyi Store. Attackers can use the vulnerability to obtain sensitive information.

TP-Link Archer C5v 1.7_181221 devices allows remote attackers to retrieve cleartext credentials via [USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0 to the /cgi?1&5 URI. TP-Link Archer C5v Contains a vulnerability in the plaintext storage of important information.Information may be obtained. TP-Link Archer C5v is an AC1200 wireless dual-band Gigabit VoIP router. TP-Link Archer C5v 1.7_181221 has an information disclosure vulnerability

On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense (versions prior to 14.1.0), or a Bot Defense profile (versions 14.1.0 and later), may subject clients and web servers to Open Redirection attacks. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. BIG-IP Advanced WAF and ASM Contains an open redirect vulnerability.Information may be obtained and information may be tampered with. F5 BIG-IP ASM is a Web Application Firewall (WAF) of F5 Corporation in the United States, which provides secure remote access, protects emails, simplifies Web access control, and enhances network and application performance. There are security vulnerabilities in BIG-IP Advanced WAF and ASM. There is no information about this vulnerability at present. Please keep an eye on CNNVD or manufacturer announcements

In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments. An attacker could predict and hijack TCP sessions. SIMATIC MV400 family Exists in unspecified vulnerabilities.Information may be tampered with. Siemens SIMATIC MV400 is an industrial equipment of Germany's Siemens (Siemens) company. Used for optical identification. The Siemens SIMATIC MV400 series TCP protocol stack has security vulnerabilities

On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. plural BIG-IP The product contains a cross-site scripting vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. There is a cross-site scripting vulnerability in BIG-IP, which stems from the lack of correct verification of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. plural BIG-IP The product contains unspecified vulnerabilities.Denial of service (DoS) It may be put into a state. There is a security vulnerability in BIG-IP. There is no information about this vulnerability at present. Please keep an eye on CNNVD or manufacturer announcements

On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, when the BIG-IP ASM system processes WebSocket requests with JSON payloads, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. BIG-IP Advanced WAF and ASM Is vulnerable to a resource exhaustion.Denial of service (DoS) It may be put into a state

On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. BIG-IP Contains an unspecified vulnerability.Denial of service (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5

On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. plural BIG-IP The product contains a vulnerability related to out-of-bounds writing.Denial of service (DoS) It may be put into a state

On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for CVE-2017-6167. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. BIG-IP and BIG-IQ Exists in a race condition vulnerability. This vulnerability is CVE-2017-6167 It is a vulnerability caused by an incomplete fix.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

On BIG-IP AFM version 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.5, authenticated users accessing the Configuration utility for AFM are vulnerable to a cross-site scripting attack if they attempt to access a maliciously-crafted URL. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. BIG-IP AFM Contains a cross-site scripting vulnerability.Information may be obtained and information may be tampered with

On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. BIG-IP Contains an unspecified vulnerability.Information may be obtained and information may be tampered with

On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated

Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may be able to exploit resulting in privilege escalation and complete control of the system. A code issue vulnerability exists in Rockwell Automation DriveTools SP and Drives AOP, which originates from an improper design or implementation problem in the code development process of a network system or product

On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic with APM, TMM consumes excessive memory. A malicious, authenticated VPN user may abuse this to perform a DoS attack against the APM. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. BIG-IP ASM Is vulnerable to a resource exhaustion.Denial of service (DoS) It may be put into a state. GE APM is an equipment monitoring system of General Electric (GE). The system can continuously monitor the operating status and faults of the equipment. There is a resource management error vulnerability in BIG-IP APM, which originates from the improper management of system resources (such as memory, disk space, files, etc.) by network systems or products

On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4, and all versions of 12.1.x and 11.6.x, big3d does not securely handle and parse certain payloads resulting in a buffer overflow. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. BIG-IP DNS and GTM Contains a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated

In Contiki 4.5, TCP ISNs are improperly random. Contiki-NG There is a vulnerability in the use of inadequate random values.Information may be obtained and information may be tampered with. Contiki is an open-source, cross-platform operating system for IoT (Internet of Things) devices. Contiki-NG is an open-source cross-platform operating system for next-generation IoT (Internet of Things) devices. A security feature issue vulnerability exists in uIP, Contiki-OS, and Contiki-NG that could allow an attacker to spoof or destroy a TCP connection