VARIoT IoT vulnerabilities database

DrayTek Vigor series routers are dual-WAN security firewall routers designed for medium-sized enterprises. DrayTek Vigor series routers have command injection vulnerabilities. Attackers can use the vulnerabilities to execute arbitrary commands to obtain router permissions.

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill). FasterXML jackson-databind Exists in an unreliable data deserialization vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. FasterXML Jackson is a data processing tool for Java developed by American FasterXML Company. jackson-databind is one of the components with data binding function. A security vulnerability exists in FasterXML jackson-databind 2.x versions prior to 2.9.10.5. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. Description: Red Hat Decision Manager is an open source decision management platform that combines business rules management, complex event processing, Decision Model & Notation (DMN) execution, and Business Optimizer for solving planning problems. It automates business decisions and makes that logic available to the entire business. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. The References section of this erratum contains a download link (you must log in to download the update). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Fuse 7.7.0 release and security update Advisory ID: RHSA-2020:3192-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2020:3192 Issue date: 2020-07-28 CVE Names: CVE-2016-4970 CVE-2018-3831 CVE-2018-11797 CVE-2018-12541 CVE-2018-1000632 CVE-2019-0231 CVE-2019-3797 CVE-2019-9511 CVE-2019-9827 CVE-2019-10086 CVE-2019-10172 CVE-2019-12086 CVE-2019-12400 CVE-2019-14540 CVE-2019-14888 CVE-2019-14892 CVE-2019-14893 CVE-2019-16335 CVE-2019-16942 CVE-2019-16943 CVE-2019-17267 CVE-2019-17531 CVE-2019-17573 CVE-2019-20330 CVE-2019-20444 CVE-2019-20445 CVE-2020-1745 CVE-2020-1757 CVE-2020-1953 CVE-2020-7238 CVE-2020-8840 CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 CVE-2020-10672 CVE-2020-10673 CVE-2020-10968 CVE-2020-10969 CVE-2020-11111 CVE-2020-11112 CVE-2020-11113 CVE-2020-11619 CVE-2020-11620 CVE-2020-14060 CVE-2020-14061 CVE-2020-14062 CVE-2020-14195 ==================================================================== 1. Summary: A minor version update (from 7.6 to 7.7) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: This release of Red Hat Fuse 7.7.0 serves as a replacement for Red Hat Fuse 7.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * netty (CVE-2016-4970 CVE-2020-7238 CVE-2019-20444 CVE-2019-20445) * dom4j (CVE-2018-1000632) * elasticsearch (CVE-2018-3831) * pdfbox (CVE-2018-11797) * vertx (CVE-2018-12541) * spring-data-jpa (CVE-2019-3797) * mina-core (CVE-2019-0231) * jackson-databind (CVE-2019-12086 CVE-2019-16335 CVE-2019-14540 CVE-2019-17267 CVE-2019-14892 CVE-2019-14893 CVE-2019-16942 CVE-2019-16943 CVE-2019-17531 CVE-2019-20330 CVE-2020-10673 CVE-2020-10672 CVE-2020-8840 CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11111 CVE-2020-11112 CVE-2020-11113 CVE-2020-11620 CVE-2020-11619 CVE-2020-14195 CVE-2020-14060 CVE-2020-14061 CVE-2020-14062) * jackson-mapper-asl (CVE-2019-10172) * hawtio (CVE-2019-9827) * undertow (CVE-2019-9511 CVE-2020-1757 CVE-2019-14888 CVE-2020-1745) * santuario (CVE-2019-12400) * apache-commons-beanutils (CVE-2019-10086) * cxf (CVE-2019-17573) * apache-commons-configuration (CVE-2020-1953) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are available from the Fuse 7.7.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/ 4. Bugs fixed (https://bugzilla.redhat.com/): 1343616 - CVE-2016-4970 netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl 1620529 - CVE-2018-1000632 dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents 1632452 - CVE-2018-3831 elasticsearch: Information exposure via _cluster/settings API 1637492 - CVE-2018-11797 pdfbox: unbounded computation in parser resulting in a denial of service 1638391 - CVE-2018-12541 vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake 1697598 - CVE-2019-3797 spring-data-jpa: Additional information exposure with Spring Data JPA derived queries 1700016 - CVE-2019-0231 mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. 1713468 - CVE-2019-12086 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. 1715075 - CVE-2019-10172 jackson-mapper-asl: XML external entity similar to CVE-2016-3720 1728604 - CVE-2019-9827 hawtio: server side request forgery via initial /proxy/ substring of a URI 1741860 - CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service 1752770 - CVE-2020-1757 undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass 1755831 - CVE-2019-16335 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource 1755849 - CVE-2019-14540 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig 1758167 - CVE-2019-17267 jackson-databind: Serialization gadgets in classes of the ehcache package 1758171 - CVE-2019-14892 jackson-databind: Serialization gadgets in classes of the commons-configuration package 1758182 - CVE-2019-14893 jackson-databind: Serialization gadgets in classes of the xalan package 1758187 - CVE-2019-16942 jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* 1758191 - CVE-2019-16943 jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource 1764658 - CVE-2019-12400 xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source 1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default 1772464 - CVE-2019-14888 undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS 1775293 - CVE-2019-17531 jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* 1793154 - CVE-2019-20330 jackson-databind: lacks certain net.sf.ehcache blocking 1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling 1797011 - CVE-2019-17573 cxf: reflected XSS in the services listing page 1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header 1798524 - CVE-2019-20444 netty: HTTP request smuggling 1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability 1815212 - CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files 1815470 - CVE-2020-10673 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution 1815495 - CVE-2020-10672 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution 1816330 - CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking 1816332 - CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config 1816337 - CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap 1816340 - CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core 1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider 1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane 1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory 1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider 1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime 1826798 - CVE-2020-11620 jackson-databind: Serialization gadgets in commons-jelly:commons-jelly 1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop 1848958 - CVE-2020-14195 jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory 1848960 - CVE-2020-14060 jackson-databind: serialization in oadd.org.apache.xalan.lib.sql.JNDIConnectionPool 1848962 - CVE-2020-14062 jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool 1848966 - CVE-2020-14061 jackson-databind: serialization in weblogic/oracle-aqjms 5. References: https://access.redhat.com/security/cve/CVE-2016-4970 https://access.redhat.com/security/cve/CVE-2018-3831 https://access.redhat.com/security/cve/CVE-2018-11797 https://access.redhat.com/security/cve/CVE-2018-12541 https://access.redhat.com/security/cve/CVE-2018-1000632 https://access.redhat.com/security/cve/CVE-2019-0231 https://access.redhat.com/security/cve/CVE-2019-3797 https://access.redhat.com/security/cve/CVE-2019-9511 https://access.redhat.com/security/cve/CVE-2019-9827 https://access.redhat.com/security/cve/CVE-2019-10086 https://access.redhat.com/security/cve/CVE-2019-10172 https://access.redhat.com/security/cve/CVE-2019-12086 https://access.redhat.com/security/cve/CVE-2019-12400 https://access.redhat.com/security/cve/CVE-2019-14540 https://access.redhat.com/security/cve/CVE-2019-14888 https://access.redhat.com/security/cve/CVE-2019-14892 https://access.redhat.com/security/cve/CVE-2019-14893 https://access.redhat.com/security/cve/CVE-2019-16335 https://access.redhat.com/security/cve/CVE-2019-16942 https://access.redhat.com/security/cve/CVE-2019-16943 https://access.redhat.com/security/cve/CVE-2019-17267 https://access.redhat.com/security/cve/CVE-2019-17531 https://access.redhat.com/security/cve/CVE-2019-17573 https://access.redhat.com/security/cve/CVE-2019-20330 https://access.redhat.com/security/cve/CVE-2019-20444 https://access.redhat.com/security/cve/CVE-2019-20445 https://access.redhat.com/security/cve/CVE-2020-1745 https://access.redhat.com/security/cve/CVE-2020-1757 https://access.redhat.com/security/cve/CVE-2020-1953 https://access.redhat.com/security/cve/CVE-2020-7238 https://access.redhat.com/security/cve/CVE-2020-8840 https://access.redhat.com/security/cve/CVE-2020-9546 https://access.redhat.com/security/cve/CVE-2020-9547 https://access.redhat.com/security/cve/CVE-2020-9548 https://access.redhat.com/security/cve/CVE-2020-10672 https://access.redhat.com/security/cve/CVE-2020-10673 https://access.redhat.com/security/cve/CVE-2020-10968 https://access.redhat.com/security/cve/CVE-2020-10969 https://access.redhat.com/security/cve/CVE-2020-11111 https://access.redhat.com/security/cve/CVE-2020-11112 https://access.redhat.com/security/cve/CVE-2020-11113 https://access.redhat.com/security/cve/CVE-2020-11619 https://access.redhat.com/security/cve/CVE-2020-11620 https://access.redhat.com/security/cve/CVE-2020-14060 https://access.redhat.com/security/cve/CVE-2020-14061 https://access.redhat.com/security/cve/CVE-2020-14062 https://access.redhat.com/security/cve/CVE-2020-14195 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.7.0 https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/ 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXyBKZtzjgjWX9erEAQi36A//TAru3rmOqPcxv1hTEGyaF3hRH4jrvn/T xRMxfu2yfExW5bRSr6GH0+YMpRkdmGVpuZtDwGoQYKIaA7dJ9XyPpBLtszfOe1pu eVoNUrEvy53KnfzxEMrA0cYPpBwXmjd52QH3xaBL0ZqoHPciM8ZuoatCL9YcCUQb mdbPLBTfn9YQL7D993E3gcG2kfgO8hEJrlDXXbMxUCuD1hJ4k2g8uvuz0IPwunQC KSe4baOZUmvUheimDzybBIdSUBlNp/OuO9NshSCOwgfYUh3Sln0HEDuUWX3MzlfF 7fDdMAl98ULF0NcElL4MHUVxcaYpwGedAkODkI9s+XXDYvi9Nuhywla2zZ48l+5t ZkN0Wlq2OE24ELjd6xE9EfCdkfABz/sOqlr3tAaH5JBXtVhgC1e15psXqVAxIR+J ePzvbYFsZXtX8klx3QF4PHh1jRILOUOy5DHZV7aSRB3bj+g4ICB96N7M4m4Qcepm s09Qn2F0DngSOvwPnO2Cltl1K07wiG2q7Y5s3INoIFQFrB88RQw6cgJWDPH5OVZ0 N7LpgYANPzL5rkvoZybTVM8oBAGfVSrIGeHq35icuivXyz/M4DAa8bVaCvReP3ai MGUG/y0fczE2ajNlHcjQJHETbIctedeIb6ojHuBvs3g6219wrqMskkZURSUtC0Tv wFoh8mUDRG4=5qqZ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Android is a smart operating system on common mobile phones and IoT devices. There is a denial of service vulnerability in Google Android. An attacker can use this vulnerability to occupy system and device resources through the native process and cause the device to crash and become unusable.

Shenzhen Jixiang Tengda Technology Co., Ltd. is a leading global network equipment provider. The Tenda AC18 router has a command execution vulnerability, which can be exploited by attackers to gain server permissions.

AC9V3.0 upgrade software is a wireless router with Gigabit Ethernet port of Shenzhen Jixiang Tengda Technology Co., Ltd. Shenzhen Jixiang Tengda Technology Co., Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability. An attacker can use this vulnerability to cause a denial of service (override the return value of the function). The constructed payload can obtain device control.

AC9V3.0 upgrade software is a Gigabit Ethernet wireless router of Shenzhen Jixiang Tengda Technology Co., Ltd. Shenzhen Jixiang Tengda Technology Co., Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability. An attacker can use this vulnerability to cause a denial of service (override the return value of the function). The constructed payload can obtain device control.

AC9V3.0 upgrade software is a Gigabit Ethernet wireless router of Shenzhen Jixiang Tengda Technology Co., Ltd. Shenzhen Jixiang Tengda Technology Co., Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability. An attacker can use this vulnerability to cause a denial of service (override the return value of the function). The constructed payload can obtain device control.

AC9V3.0 upgrade software is a Gigabit Ethernet wireless router of Shenzhen Jixiang Tengda Technology Co., Ltd. Shenzhen Jixiang Tengda Technology Co., Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability. An attacker can use this vulnerability to cause a denial of service (override the return value of the function). The constructed payload can obtain device control.

AC9V3.0 upgrade software is a Gigabit Ethernet wireless router of Shenzhen Jixiang Tengda Technology Co., Ltd. Shenzhen Jixiang Tengda Technology Co., Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability. An attacker can use this vulnerability to cause a denial of service (override the return value of the function). The constructed payload can obtain device control.

Yinghantong InRouter615-S series industrial LTE router is a 4G industrial router. There is a command execution vulnerability in InRouter615-S series industrial LTE routers, which can be exploited by attackers to execute malicious code.

AC9V3.0 upgrade software is a Gigabit Ethernet wireless router of Shenzhen Jixiang Tengda Technology Co., Ltd. Shenzhen Jixiang Tengda Technology Co., Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability. An attacker can use this vulnerability to cause a denial of service (override the return value of the function). The constructed payload can obtain device control.

GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages

GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs. An information disclosure vulnerability exists in GeoVision GV-GF192x v1.10. Attackers can use this vulnerability to obtain log information

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key. FortiManager Contains a vulnerability in the use of hard-coded credentials.Information may be obtained. Both Fortinet FortiManager and Fortinet FortiAnalyzer are products of Fortinet. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains (ADOMs) to further simplify multi-device security deployment and management. Fortinet FortiAnalyzer is a centralized network security reporting solution. This product is mainly used to collect network log data, and analyze, report, and archive the security events, network traffic, and Web content in the logs through the report suite

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. The parsing mechanism that processes certain file types does not provide input sanitation. This may allow an attacker to use specially crafted files to traverse the file system and modify or expose sensitive data or execute arbitrary code. Rockwell Automation Provided by the company FactoryTalk Linx Software The following multiple vulnerabilities exist in. * Improper input confirmation (CWE-20) - CVE-2020-11999 * Improper input confirmation (CWE-20) - CVE-2020-12001 * Directory traversal (CWE-22) - CVE-2020-12003 * Upload any file (CWE-434) - CVE-2020-12005The expected impact depends on each vulnerability, but it may be affected as follows. - CVE-2020-12001 * API Sensitive information on the local hard drive is stolen by a remote third party because it does not properly sanitize the specially crafted request during the call. - CVE-2020-12003 * Improperly compressed by a remote third party EDF By uploading the file, the compressed file can be decompressed. CPU All resources are consumed and service operation is interrupted (DoS) The condition is triggered - CVE-2020-12005. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Studio 5000. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the CopyRenameProject parameter provided to hmi_isapi.dll. The issue results from the lack of proper validation of user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Rockwell Automation RSLinx Classic and others are products of Rockwell Automation (USA). Rockwell Automation RSLinx Classic is a set of industrial communication solutions. Rockwell Automation ControlFLASH is a firmware update utility. The vulnerability stems from the failure of the resolution mechanism to clean up the input

WideField3 is a PLC programming software developed by Yokogawa Electric Group. WideField3 has a command execution vulnerability, which can be exploited by attackers to execute malicious code.

Advantech WebAccess/SCADA is a set of SCADA software based on browser architecture of Chinese company Advantech (Advantech). Advantech WebAccess/SCADA has an arbitrary file deletion vulnerability, which can be exploited by an attacker to delete arbitrary files on the server.

Advantech WebAccess/SCADA is a set of SCADA software based on browser architecture of Chinese company Advantech (Advantech). Advantech WebAccess/SCADA has an arbitrary file deletion vulnerability, which can be exploited by an attacker to delete arbitrary files on the server.

Advantech WebAccess/SCADA is a set of SCADA software based on browser architecture of Chinese company Advantech (Advantech). Advantech WebAccess/SCADA has an arbitrary file deletion vulnerability, which can be exploited by an attacker to delete arbitrary files on the server.