VARIoT IoT vulnerabilities database

Modicon M580 BMEP584040 is a programmable Ethernet automation controller from Schneider. Schneider Electric Modicon M580 BMEP584040 has a denial of service vulnerability that an attacker can use to cause a denial of service.

Modicon M580 BMEP584040 is a programmable Ethernet automation controller from Schneider. Schneider Electric Modicon M580 BMEP584040 has an authentication bypass vulnerability, which can be exploited by attackers to replay operation instructions.

Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted field name. Nozomi Guardian Exists in a cross-site scripting vulnerability.Information may be obtained and tampered with. Nozomi Networks Guardian is a IoT device and software inspection system from Nozomi Networks in Switzerland. The vulnerability stems from the lack of proper verification of client data by WEB applications. Attackers can use this vulnerability to execute client code

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472. DrayTek Vigor3900 , Vigor2960 , Vigor300B On the device OS A command injection vulnerability exists. This vulnerability is CVE-2020-14472 Is a different vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. DrayTek Vigor3900, etc. are all products of DrayTek, Taiwan, China. DrayTek Vigor3900 is a broadband router/VPN gateway device. Vigor2960 is a load balancing router and VPN gateway device. Vigor300B is a load balancing router. Attackers can use shell metacharacters to use this vulnerability to execute commands

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow. LibVNCServer Is vulnerable to lack of entropy.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. 8) - aarch64, ppc64le, x86_64 3. ========================================================================== Ubuntu Security Notice USN-4407-1 July 01, 2020 libvncserver vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 19.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in LibVNCServer. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2019-15680) It was discovered that an information disclosure vulnerability existed in LibVNCServer when sending a ServerCutText message. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681) It was discovered that LibVNCServer incorrectly handled cursor shape updates. If a user were tricked in to connecting to a malicious server, an attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2017-18922) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: libvncclient1 0.9.12+dfsg-9ubuntu0.1 libvncserver1 0.9.12+dfsg-9ubuntu0.1 Ubuntu 19.10: libvncclient1 0.9.11+dfsg-1.3ubuntu0.1 libvncserver1 0.9.11+dfsg-1.3ubuntu0.1 Ubuntu 18.04 LTS: libvncclient1 0.9.11+dfsg-1ubuntu1.2 libvncserver1 0.9.11+dfsg-1ubuntu1.2 Ubuntu 16.04 LTS: libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.4 libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.4 After a standard system update you need to restart LibVNCServer to make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: libvncserver security update Advisory ID: RHSA-2020:3281-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:3281 Issue date: 2020-08-03 CVE Names: CVE-2017-18922 ==================================================================== 1. Summary: An update for libvncserver is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: LibVNCServer is a C library that enables you to implement VNC server functionality into own programs. Security Fix(es): * libvncserver: websocket decoding buffer overflow (CVE-2017-18922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1852356 - CVE-2017-18922 libvncserver: websocket decoding buffer overflow 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: libvncserver-0.9.9-14.el7_8.1.src.rpm x86_64: libvncserver-0.9.9-14.el7_8.1.i686.rpm libvncserver-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-devel-0.9.9-14.el7_8.1.i686.rpm libvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: libvncserver-0.9.9-14.el7_8.1.src.rpm ppc64le: libvncserver-0.9.9-14.el7_8.1.ppc64le.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.ppc64le.rpm x86_64: libvncserver-0.9.9-14.el7_8.1.i686.rpm libvncserver-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64le: libvncserver-debuginfo-0.9.9-14.el7_8.1.ppc64le.rpm libvncserver-devel-0.9.9-14.el7_8.1.ppc64le.rpm x86_64: libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-devel-0.9.9-14.el7_8.1.i686.rpm libvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: libvncserver-0.9.9-14.el7_8.1.src.rpm x86_64: libvncserver-0.9.9-14.el7_8.1.i686.rpm libvncserver-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-devel-0.9.9-14.el7_8.1.i686.rpm libvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-18922 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXygVLdzjgjWX9erEAQjn5BAAmrE0XEfwDvLUYWQkFeamAij8uUnf12Z4 fJQmIn0PlNFlNJXtSChiqf0EKTk6cAuaGF+g2FBX1AeTDxqRmTZpvR8YFyw1GK0h OjScrrLyU4F0q+kgGS3S39bpBydUGaUefw+rB/Slg6NNT2+EEKHo6pogYrsJE7hP LlrrfTIGnfS3NOZj/co4Kx1MWG2EswZ0gJXlho4o7ZPuPZOWLLv3tqzoVl86UEhG XJtN1lWzW0jy/QRsN88/MWC+RXAEyTja37CHX+l+Se+RdN3G0BqoNEflnNxXtSZR 1b+0VWFhqV/R3djpB7c/geCV5OW1n9InMvmdkcnXIbfA8WIUNbNGxcEAHX7SsZ1C yPsu9CrEef5ZuXycTyeLNam6wYwZiaTOkNuui3yAzmyvZOkyPZHhCYgzI31Xy7Jy OkCgxVebn0sxxle6aq3lm3g1c09Fw7eLgKFE2WJnUElWSql1peD2WaAcXFFkhgNI M3drMJzvG0B0aR+qvtIQARnsKlkMxrgaVXRa3S3ZGlFigTwao2CSI/2xHEvx0QfT tw2oTKLjboVuwBwnEj2MltXKSvSnHKSExF5Y0EnIJnZRg1XzPGavnAwjVk1k3uSg yT9Db8jds1GXsWoVyqfflp5qUhIpfrtA50pagzIIGyqE9zjiyW+S8+YZdMwXtYa8 qgB/RwEdM5k=1gVa -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 8.1) - ppc64le, x86_64 3

Mimosa Networks is a global technology leader in wireless broadband solutions, providing fast fiber optic connections for global service providers and corporate, industrial and government operators. Mimosa Routers has an unauthorized RCE vulnerability. Attackers can use this vulnerability to execute arbitrary commands on the target device with root privileges.

Ruijie RG-RSR20-14E is a multi-service router. The RG-RSR20-14E router has a logic flaw vulnerability, and an attacker can use the vulnerability to upgrade permissions.

Ruijie RG-RSR20-14E is a multi-service router. The RG-RSR20-14E router has an unauthorized access vulnerability, and an attacker can use the vulnerability to clear or modify the administrator user password.

Ruijie RG-RSR20-14E is a multi-service router. The RG-RSR20-14E router has a file upload vulnerability, which can be exploited by attackers to upload forged log files.

The EPX3000 series is a high-performance multimedia communication switching equipment, which is mainly suitable for various enterprise multimedia communication business applications. There is a SQL injection vulnerability in the EPX3000 configuration management system. Attackers can use this vulnerability to obtain sensitive information in the database.

The EPX3000 series is a high-performance multimedia communication switching equipment, which is mainly suitable for various enterprise multimedia communication business applications. The EPX3000 configuration management system has an arbitrary file download vulnerability, which can be exploited by an attacker to download arbitrary files.

Ruijie RG-RSR20-14E is a multi-service router. The RG-RSR20-14E router has a denial of service vulnerability, which can be exploited by an attacker to restart the router.

Haiwell cloud configuration software Cloud SCADA is a .NET Framework-based industrial automation monitoring and management platform software developed by Xiamen Haiwei Technology Co., Ltd. Haiwell (Haiwei) cloud configuration software Cloud SCADA has SQL injection vulnerabilities, attackers can use the vulnerabilities to obtain sensitive database information.

Advantech WebAccessNode is a HMI/SCADA monitoring software based entirely on IE browser Advantech WebAccessNode has an arbitrary path file deletion vulnerability. An attacker can use the vulnerability to delete any path file in the system.

Advantech WebAccessNode is a HMI/SCADA monitoring software based entirely on IE browser Advantech WebAccessNode has an arbitrary path file deletion vulnerability. An attacker can use the vulnerability to delete any path file in the system.

The web interface of Maipu MP1800X-50 7.5.3.14(R) devices allows remote attackers to obtain sensitive information via the form/formDeviceVerGet URI, such as system id, hardware model, hardware version, bootloader version, software version, software image file, compilation time, and system uptime. This is similar to CVE-2019-1653. Maipu MP1800X-50 The device contains a vulnerability related to information leakage. This vulnerability is CVE-2019-1653 It is the same vulnerability as.Information may be obtained. Maipu MP1800X-50 is an enterprise-level multi-service router of China Maipu Communication Technology (Maipu) Company. The web interface in Maipu MP1800X-50 7.5.3.14 has security vulnerabilities

iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP addresses. iBall WRB303N A cross-site request forgery vulnerability exists in the device.Information may be tampered with. Best IT World iBall WRB303N is a wireless router from Best IT World in India. The vulnerability stems from the fact that the WEB application does not fully verify whether the request comes from a trusted user. An attacker can use this vulnerability to send unexpected requests to the server through the affected client

Haiwell cloud configuration software Cloud SCADA is a .NET Framework-based industrial automation monitoring and management platform software developed by Xiamen Haiwei Technology Co., Ltd. Haiwell's cloud configuration software Cloud SCADA has a remote password modification vulnerability. An attacker can use the vulnerability to modify the password of the operating system.

Haiwell cloud configuration software Cloud SCADA is a .NET Framework-based industrial automation monitoring and management platform software developed by Xiamen Haiwei Technology Co., Ltd. There is a code execution vulnerability in Haiwell's cloud configuration software Cloud SCADA, which can be exploited by an attacker to execute arbitrary code on a remote server.

Haiwell cloud configuration software Cloud SCADA is a .NET Framework-based industrial automation monitoring and management platform software developed by Xiamen Haiwei Technology Co., Ltd. Haiwell's cloud configuration software Cloud SCADA has a command execution vulnerability that an attacker can use to obtain server permissions.