VARIoT IoT vulnerabilities database

An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple buffer overflow vulnerabilities exist in CGI scripts, leading to remote code execution with root privileges. (The set of affected scripts is similar to CVE-2020-12266.). Wavlink WL-WN530HG4 A classic buffer overflow vulnerability exists on the device. This vulnerability is CVE-2020-12266 It is a similar problem to.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. WAVLINK WL-WN530HG4 is a wireless network signal extender manufactured by WAVLINK. There is a security vulnerability in the WAVLINK WL-WN530HG4 M30HG4.V5030.191116 version

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. F5 BIG-IP devices provide load-balancing capability to application services such as HTTP and DNS. The F5 BIG-IP TMUI management web interface improperly neutralizes untrusted user input and can be abused by unauthenticated remote attackers to perform malicious activities such as cross-site scripting (XSS), cross-site request forgery (CSRF), and command injection CWE-74. F5 has also announced that BIG-IP devices do not properly enforce access controls to sensitive configuration files that be read and overwritten by an authenticated user via Secure Copy (SCP). The vulnerability identified by CVE-2020-0592 can be abused to achieve arbitrary code execution on the target device with root privileges. Underlying causes and factors in these vulnerabilities include: Improper configuration and a lack of identify checks, see recent article from NCC Group. Understanding the root cause of F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902 The TMUI fails to enforce proper authentication and authorization, see OWASP Recommendations The TMUI web interface does not normalize user's input to prevent both XSS and CSRF, allowing a "Deadly Combinations of XSS and CSRF" Lack of role-based access checks allows for for unexpected file access, see Role-Based Access Control Models F5 recommends that the TMUI web interface should be accessible only from a secure or an out-of-band network and not directly from the Internet (K13092). However, many installations, as observed by Bad Packets, do not seem to follow this recommendation. An unauthenticated attacker with network access to the TMUI may be able to execute arbitrary system commands, create or delete files, disable services, and subsequently execute arbitrary code with high privileges such as root. An authenticated user is also be able to perform unexpected activities such as changing configuration files on a vulnerable device. plural BIG-IP The product contains a code injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in the F5 BIG-IP. The following products and versions are affected: F5 BIG-IP Version 15.1.0, Version 15.0.0, Version 14.1.0 to Version 14.1.2, Version 13.1.0 to Version 13.1.3, Version 12.1.0 to Version 12.1.5 , version 11.6.1 to version 11.6.5. ## RCE: curl -v -k 'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin' ## Read File: curl -v -k 'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files. F5 BIG-IP provides a Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that has multiple vulnerabilities including a remotely exploitable command injection vulnerability that can be used to execute arbitrary commands and subsequently take control of a vulnerable system. F5 BIG-IP devices provide load-balancing capability to application services such as HTTP and DNS. The F5 BIG-IP TMUI management web interface improperly neutralizes untrusted user input and can be abused by unauthenticated remote attackers to perform malicious activities such as cross-site scripting (XSS), cross-site request forgery (CSRF), and command injection CWE-74. F5 has also announced that BIG-IP devices do not properly enforce access controls to sensitive configuration files that be read and overwritten by an authenticated user via Secure Copy (SCP). The vulnerability identified by CVE-2020-0592 can be abused to achieve arbitrary code execution on the target device with root privileges. Underlying causes and factors in these vulnerabilities include: Improper configuration and a lack of identify checks, see recent article from NCC Group. Understanding the root cause of F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902 The TMUI fails to enforce proper authentication and authorization, see OWASP Recommendations The TMUI web interface does not normalize user's input to prevent both XSS and CSRF, allowing a "Deadly Combinations of XSS and CSRF" Lack of role-based access checks allows for for unexpected file access, see Role-Based Access Control Models F5 recommends that the TMUI web interface should be accessible only from a secure or an out-of-band network and not directly from the Internet (K13092). However, many installations, as observed by Bad Packets, do not seem to follow this recommendation. An unauthenticated attacker with network access to the TMUI may be able to execute arbitrary system commands, create or delete files, disable services, and subsequently execute arbitrary code with high privileges such as root. An authenticated user is also be able to perform unexpected activities such as changing configuration files on a vulnerable device. BIG-IP APM There is an information leakage vulnerability in.Information may be obtained. F5 BIG-IP APM is a set of access and security solutions from F5 Corporation of the United States. The product provides unified access to business-critical applications and networks

Earlier than HiSuite 10.1.0.500 have a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allows an attacker to load this DLL file of the attacker's choosing. HiSuite Exists in an unreliable search path vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Huawei HiSuite is a mobile phone assistant application for PC from Huawei, China

A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensitive information in clear text. The vulnerability is due to insecure storage of certain unencrypted credentials on an affected device. An attacker could exploit this vulnerability by viewing the network device configuration and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to discover and manage network devices. The solution scales and protects devices, applications, and more within the network

A Vulnerability in the firmware of COMMAX WallPad(CDP-1020MB) allow an unauthenticated adjacent attacker to execute arbitrary code, because of a using the old version of MySQL. COMMAX WallPad(CDP-1020MB) There is an input verification vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. COMMAX WallPad is a smart home control panel produced by South Korean company COMMAX. There is an input validation error vulnerability in COMMAX WallPad CDP-1020MB version before 2019.12.30

Modicon M580 BMEP584040 is a programmable Ethernet automation controller from Schneider. Schneider Electric Modicon M580 BMEP584040 has a denial of service vulnerability that an attacker can use to cause a denial of service.

Modicon M580 BMEP584040 is a programmable Ethernet automation controller from Schneider. Schneider Electric Modicon M580 BMEP584040 has an authentication bypass vulnerability, which can be exploited by attackers to replay operation instructions.

Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted field name. Nozomi Guardian Exists in a cross-site scripting vulnerability.Information may be obtained and tampered with. Nozomi Networks Guardian is a IoT device and software inspection system from Nozomi Networks in Switzerland. The vulnerability stems from the lack of proper verification of client data by WEB applications. Attackers can use this vulnerability to execute client code

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472. DrayTek Vigor3900 , Vigor2960 , Vigor300B On the device OS A command injection vulnerability exists. This vulnerability is CVE-2020-14472 Is a different vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. DrayTek Vigor3900, etc. are all products of DrayTek, Taiwan, China. DrayTek Vigor3900 is a broadband router/VPN gateway device. Vigor2960 is a load balancing router and VPN gateway device. Vigor300B is a load balancing router. Attackers can use shell metacharacters to use this vulnerability to execute commands

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow. LibVNCServer Is vulnerable to lack of entropy.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. 8) - aarch64, ppc64le, x86_64 3. ========================================================================== Ubuntu Security Notice USN-4407-1 July 01, 2020 libvncserver vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 19.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in LibVNCServer. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2019-15680) It was discovered that an information disclosure vulnerability existed in LibVNCServer when sending a ServerCutText message. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681) It was discovered that LibVNCServer incorrectly handled cursor shape updates. If a user were tricked in to connecting to a malicious server, an attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2017-18922) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: libvncclient1 0.9.12+dfsg-9ubuntu0.1 libvncserver1 0.9.12+dfsg-9ubuntu0.1 Ubuntu 19.10: libvncclient1 0.9.11+dfsg-1.3ubuntu0.1 libvncserver1 0.9.11+dfsg-1.3ubuntu0.1 Ubuntu 18.04 LTS: libvncclient1 0.9.11+dfsg-1ubuntu1.2 libvncserver1 0.9.11+dfsg-1ubuntu1.2 Ubuntu 16.04 LTS: libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.4 libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.4 After a standard system update you need to restart LibVNCServer to make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: libvncserver security update Advisory ID: RHSA-2020:3281-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:3281 Issue date: 2020-08-03 CVE Names: CVE-2017-18922 ==================================================================== 1. Summary: An update for libvncserver is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: LibVNCServer is a C library that enables you to implement VNC server functionality into own programs. Security Fix(es): * libvncserver: websocket decoding buffer overflow (CVE-2017-18922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1852356 - CVE-2017-18922 libvncserver: websocket decoding buffer overflow 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: libvncserver-0.9.9-14.el7_8.1.src.rpm x86_64: libvncserver-0.9.9-14.el7_8.1.i686.rpm libvncserver-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-devel-0.9.9-14.el7_8.1.i686.rpm libvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: libvncserver-0.9.9-14.el7_8.1.src.rpm ppc64le: libvncserver-0.9.9-14.el7_8.1.ppc64le.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.ppc64le.rpm x86_64: libvncserver-0.9.9-14.el7_8.1.i686.rpm libvncserver-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64le: libvncserver-debuginfo-0.9.9-14.el7_8.1.ppc64le.rpm libvncserver-devel-0.9.9-14.el7_8.1.ppc64le.rpm x86_64: libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-devel-0.9.9-14.el7_8.1.i686.rpm libvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: libvncserver-0.9.9-14.el7_8.1.src.rpm x86_64: libvncserver-0.9.9-14.el7_8.1.i686.rpm libvncserver-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-devel-0.9.9-14.el7_8.1.i686.rpm libvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-18922 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXygVLdzjgjWX9erEAQjn5BAAmrE0XEfwDvLUYWQkFeamAij8uUnf12Z4 fJQmIn0PlNFlNJXtSChiqf0EKTk6cAuaGF+g2FBX1AeTDxqRmTZpvR8YFyw1GK0h OjScrrLyU4F0q+kgGS3S39bpBydUGaUefw+rB/Slg6NNT2+EEKHo6pogYrsJE7hP LlrrfTIGnfS3NOZj/co4Kx1MWG2EswZ0gJXlho4o7ZPuPZOWLLv3tqzoVl86UEhG XJtN1lWzW0jy/QRsN88/MWC+RXAEyTja37CHX+l+Se+RdN3G0BqoNEflnNxXtSZR 1b+0VWFhqV/R3djpB7c/geCV5OW1n9InMvmdkcnXIbfA8WIUNbNGxcEAHX7SsZ1C yPsu9CrEef5ZuXycTyeLNam6wYwZiaTOkNuui3yAzmyvZOkyPZHhCYgzI31Xy7Jy OkCgxVebn0sxxle6aq3lm3g1c09Fw7eLgKFE2WJnUElWSql1peD2WaAcXFFkhgNI M3drMJzvG0B0aR+qvtIQARnsKlkMxrgaVXRa3S3ZGlFigTwao2CSI/2xHEvx0QfT tw2oTKLjboVuwBwnEj2MltXKSvSnHKSExF5Y0EnIJnZRg1XzPGavnAwjVk1k3uSg yT9Db8jds1GXsWoVyqfflp5qUhIpfrtA50pagzIIGyqE9zjiyW+S8+YZdMwXtYa8 qgB/RwEdM5k=1gVa -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 8.1) - ppc64le, x86_64 3

Mimosa Networks is a global technology leader in wireless broadband solutions, providing fast fiber optic connections for global service providers and corporate, industrial and government operators. Mimosa Routers has an unauthorized RCE vulnerability. Attackers can use this vulnerability to execute arbitrary commands on the target device with root privileges.

Ruijie RG-RSR20-14E is a multi-service router. The RG-RSR20-14E router has a logic flaw vulnerability, and an attacker can use the vulnerability to upgrade permissions.

Ruijie RG-RSR20-14E is a multi-service router. The RG-RSR20-14E router has an unauthorized access vulnerability, and an attacker can use the vulnerability to clear or modify the administrator user password.

Ruijie RG-RSR20-14E is a multi-service router. The RG-RSR20-14E router has a file upload vulnerability, which can be exploited by attackers to upload forged log files.

The EPX3000 series is a high-performance multimedia communication switching equipment, which is mainly suitable for various enterprise multimedia communication business applications. There is a SQL injection vulnerability in the EPX3000 configuration management system. Attackers can use this vulnerability to obtain sensitive information in the database.

The EPX3000 series is a high-performance multimedia communication switching equipment, which is mainly suitable for various enterprise multimedia communication business applications. The EPX3000 configuration management system has an arbitrary file download vulnerability, which can be exploited by an attacker to download arbitrary files.

Ruijie RG-RSR20-14E is a multi-service router. The RG-RSR20-14E router has a denial of service vulnerability, which can be exploited by an attacker to restart the router.

Haiwell cloud configuration software Cloud SCADA is a .NET Framework-based industrial automation monitoring and management platform software developed by Xiamen Haiwei Technology Co., Ltd. Haiwell (Haiwei) cloud configuration software Cloud SCADA has SQL injection vulnerabilities, attackers can use the vulnerabilities to obtain sensitive database information.

Advantech WebAccessNode is a HMI/SCADA monitoring software based entirely on IE browser Advantech WebAccessNode has an arbitrary path file deletion vulnerability. An attacker can use the vulnerability to delete any path file in the system.