VARIoT IoT vulnerabilities database

ZLAN5102/ZLAN5103 serial server is an industrial-grade protocol converter between RS232/485 and TCP/IP produced by Shanghai ZLAN. ZLAN serial server has a denial of service vulnerability. Attackers can use the vulnerability to cause the device to deny service and restart.

China Mobile Railcom's main business is communication technology, information system development, consulting services, and construction project management. China Mobile Railcom's Suzhou branch Yu Luqi has a logic flaw vulnerability. Attackers can use the vulnerability to gain unauthorized access to the system background.

China Mobile Tietong Intelligent Products Branch is a branch of China Mobile Tietong specializing in intelligent manufacturing, intelligent integration and intelligent operation. China Mobile Railway Tongyu routing has a weak password vulnerability, attackers can use the vulnerability to log in to the system background.

The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>. Shenzhen Zhongxing Mobile Communication Co., Ltd. was established in 2002 and is headquartered in Shenzhen High-tech Industrial Park. It is a national high-tech enterprise. Attackers can use the vulnerability to obtain user cookie information

The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users. This affects: <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>. ZTE Server management software contains an authentication vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Shenzhen Zhongxing Mobile Communication Co., Ltd. was established in 2002 and is headquartered in Shenzhen High-tech Industrial Park. It is a national high-tech enterprise. There is an unauthorized access vulnerability in the ZTE server, which can be exploited by attackers to gain server permissions. ZTE R5300G4, R8500G4, and R5500G4 devices could allow a remote malicious user to execute arbitrary commands on the system, caused by improper authentication validation

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03_HOTFIX WiFi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the SOAPAction header, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10084. D-Link DAP-1860 To OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-10084 Was numbered.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. D-Link DAP-1860 is a WiFi range extender manufactured by D-Link in Taiwan. This vulnerability does not correctly verify the characters submitted by the user before executing the system call

AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2_Upgrade_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 (UX450FDX, UX550GDX and UX550GEX) could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name. ASUS PC for ScreenPad2_Upgrade_Tool.msi Exists in an unreliable search path vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. ASUS ScreenPad2 Upgrade Tool is an update tool for ASUS ScreenPad2 touchpad produced by ASUS, Taiwan, China. A code issue vulnerability exists in the AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe files in ASUS ScreenPad2 Upgrade Tool version 1.0.3. An attacker could exploit this vulnerability to execute code

BDCOM F5100-48 NGFW next-generation firewall is a firewall product designed and launched by Shanghai BORDA Data Communication Co., Ltd. for medium-sized network security demand scenarios such as enterprises, governments, hotels, hospitals, and schools. Shanghai BDCOM F5100-48 NGFW next-generation firewall has an arbitrary file download vulnerability. Attackers can use this vulnerability to download arbitrary files, resulting in the disclosure of sensitive system information.

New H3C Technology Co., Ltd. is committed to becoming a trusted partner for customers' business innovation and digital transformation. The web network management system of New H3C Technology Co., Ltd. has an arbitrary file download vulnerability. Attackers can use this vulnerability to download arbitrary files on the server and obtain sensitive information.

The RG-WALL 1600-E800 brand new next-generation firewall is a firewall product launched by Ruijie Networks, which has rich interfaces, flexible configuration, and integrates security, routing, and switching. The new generation firewall of Ruijie Networks Co., Ltd. RG-WALL 1600-E800 has an arbitrary file download vulnerability. Attackers can use this vulnerability to download arbitrary files, resulting in the disclosure of sensitive system information.

The AC15 upgrade software is produced by Shenzhen Jixiang Tengda Technology Co., Ltd. It has a built-in dual-core processor with DDR3 memory. Shenzhen Jixiang Tengda Technology Co., Ltd. AC15 upgrade software has a command execution vulnerability. Attackers can use the vulnerability to gain control of the server.

The AC15 upgrade software is produced by Shenzhen Jixiang Tengda Technology Co., Ltd. It has a built-in dual-core processor with DDR3 memory. Shenzhen Jixiang Tengda Technology Co., Ltd. AC15 upgrade software has a command execution vulnerability. Attackers can use the vulnerability to gain control of the server.

The AC15 upgrade software is produced by Shenzhen Jixiang Tengda Technology Co., Ltd. It has a built-in dual-core processor with DDR3 memory. Shenzhen Jixiang Tengda Technology Co., Ltd. AC15 upgrade software has a command execution vulnerability. Attackers can use the vulnerability to gain control of the server.

ZXR10 ZSR V2 series routers are the next-generation intelligent access router products launched by ZTE that integrate routing, switching, wireless, security, VPN, and AC. ZTE Corporation's ZXR10 ZSR V2 next-generation access router has a weak password vulnerability. Attackers can use this vulnerability to obtain sensitive information.

Advantech WebAccessNode is a HMI/SCADA monitoring software based entirely on IE browser. Advantech WebAccessNode has a code execution vulnerability, which can be exploited by attackers to obtain server administrator permissions.

Proficy Machine Edition is a PLC programming software developed by Emerson Trading (Shanghai) Co., Ltd. It is used to design, debug, program, and maintain GE RX 3i and GE RX7i series PLCs. It is widely used in electric power, machinery manufacturing, steel, and petroleum. , Chemical and other industrial control fields. Proficy Machine Edition has a denial of service vulnerability. Attackers can use the vulnerability to send constructed malicious data packets to cause a denial of service.

Shenzhen Fuji Intelligent System Co., Ltd. is a supplier of intelligent entrance and exit management equipment and a professional supplier of intelligent ecological environment solutions. There is a file upload vulnerability in the smart car license plate recognition machine. Attackers can use the vulnerability to obtain server permissions.

Proficy Machine Edition is a PLC programming software developed by Emerson Trading (Shanghai) Co., Ltd. It is used to design, debug, program, and maintain GE RX 3i and GE RX7i series PLCs. It is widely used in electric power, machinery manufacturing, steel, and petroleum. , Chemical and other industrial control fields. Proficy Machine Edition has a denial of service vulnerability. Attackers can use the vulnerability to send constructed malicious data packets to cause a denial of service.

Advantech WebAccessNode is a HMI/SCADA monitoring software based entirely on IE browser. Advantech WebAccessNode has an arbitrary file deletion vulnerability. Attackers can use the vulnerability to delete files in any path in the system.

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API. (DoS) It may be put into a state. Grandstream UCM6200 is a set of enterprise-level switches used for IP telephone communications from Grandstream