VARIoT IoT vulnerabilities database

On BIG-IP DNS 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, undisclosed series of DNS requests may cause TMM to restart and generate a core file. F5 Networks of BIG-IP Domain Name System (DNS) Exists in unspecified vulnerabilities.Service operation interruption (DoS) It may be in a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. There is a security vulnerability in F5 BIG-IP, which can be exploited by an attacker to trigger a fatal error through the DNS request of F5 BIG-IP to trigger a denial of service

On versions 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when a BIG-IP APM virtual server processes traffic of an undisclosed nature, the Traffic Management Microkernel (TMM) stops responding and restarts. F5 Networks of BIG-IP Access Policy Manager (APM) Exists in unspecified vulnerabilities.Service operation interruption (DoS) It may be in a state. F5 BIG-IP APM is a set of access and security solutions from F5 Corporation of the United States. The product provides unified access to business-critical applications and networks. F5 BIG-IP APM has a security vulnerability that can be exploited by an attacker to trigger a fatal error through the F5 BIG-IP APM virtual server to trigger a denial

HG6821M is a light cat. China Mobile Communications Co., Ltd. HG6821M has an unauthorized access vulnerability. An attacker can use the vulnerability to obtain the administrator password of the device.

There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1). A module does not deal with specific message properly, which makes a function refer to memory after it has been freed. Attackers can exploit this vulnerability by running a crafted application with common privilege. This would compromise normal service. Taurus-AL00A Is vulnerable to the use of freed memory.Denial of service (DoS) It may be put into a state. The Huawei Taurus-AL00A is a smartphone from the Chinese company Huawei. A resource management error vulnerability exists in Huawei Taurus-AL00A

Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability resulting in undefined behaviour, or a crash of the affected systems. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Dell BSAFE Micro Edition Suite is a development toolkit developed by Dell, which can provide encryption, certificate and transport layer security for c/c++ applications, devices and systems

Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to modify and corrupt the encrypted data. Dell BSAFE Micro Edition Suite is a development toolkit developed by Dell, which can provide encryption, certificate and transport layer security for c/c++ applications, devices and systems

There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00. A module is lack of authentication. Attackers without access to the module can exploit this vulnerability to obtain extra information, leading to information leak. Huawei Imanager Neteco 6000 is a platform provided by China's Huawei (Huawei) to provide management methods for data center infrastructure. The platform can implement unified management for medium and large data centers and multi-data centers. Through U-level fine-grained management of assets in the data center, dynamic balance and optimization of power, cooling, space, network ports and other means can improve the resources in the data center. utilization rate

There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnormal messages, remote attackers may exploit this vulnerability to cause a denial of service (DoS) on the specific module. plural Huawei There are unspecified vulnerabilities in smartphones.Denial of service (DoS) It may be put into a state

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076. NETGEAR Orbi Has OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-11076 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-960L Wi-Fi cameras. Authentication is not required to exploit this vulnerability.The specific flaw exists within the HTTP server, which listens on TCP port 80 by default. A crafted Authorization header in an HTTP request can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-960L Wi-Fi cameras. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of login action requests. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of the device.

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10912. Zero Day Initiative To this vulnerability ZDI-CAN-10912 Was numbered.Information may be obtained

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-960L Wi-Fi cameras. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of HNAP login requests. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of the device.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-960L Wi-Fi cameras. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the Cookie request header. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of the device.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. When parsing the path parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-10911. D-Link DVA-2800 and DSL-2888A A command injection vulnerability exists in the router. Zero Day Initiative To this vulnerability ZDI-CAN-10911 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. D-link DSL-2888A is a unified service router of China D-link Corporation. The vulnerability stems from the fact that the network system or product does not properly filter special elements in the process of constructing executable commands from external input data

An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacker to execute arbitrary commands, due to a lack of validation of inputs provided in multipart HTTP POST requests. D-Link DSR-250 The device is vulnerable to input verification, and OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. D-Link DSR-250 is an 8-port Gigabit VPN router with dynamic Web content filtering. D-Link DSR-250 3.17 has a command injection vulnerability in the Unified Services Router web interface. Attackers can use this vulnerability to execute arbitrary commands

An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to inject arbitrary crontab entries into saved configurations before uploading. These entries are executed as root. D-Link DSR-250 A device contains a vulnerability related to inadequate data integrity verification.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. D-Link DSR-250 is an 8-port Gigabit VPN router with dynamic Web content filtering. D-Link DSR-250 3.17 has a command injection vulnerability. The vulnerability stems from insufficient verification of the configuration file checksum

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17. plural D-Link For routers made OS There are command injection vulnerabilities and input verification vulnerabilities.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

This issue was addressed with improved setting propagation. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. An attacker in a privileged network position may be able to unexpectedly alter application state. plural Apple There are unspecified vulnerabilities in the product.Information may be tampered with. Apple macOS is a set of dedicated operating systems developed by Apple Corporation for Mac computers. There is a security vulnerability in Apple macOS. There is no information about this vulnerability at present. Please keep an eye on CNNVD or manufacturer announcements. Apple macOS could allow a local authenticated malicious user to bypass security restrictions, caused by an error in the HomeKit component

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. An application may be able to execute arbitrary code with kernel privileges. plural Apple The product contains a usage of freed memory vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Apple macOS is a set of dedicated operating systems developed by Apple Corporation for Mac computers. There is a security vulnerability in Apple macOS. There is no information about this vulnerability at present. Please keep an eye on CNNVD or manufacturer announcements. Apple macOS could allow a local malicious user to gain elevated privileges on the system, caused by a use-after-free in the Kernel component