VARIoT IoT vulnerabilities database

A possible buffer overflow would occur while processing command from firmware due to the group_id obtained from the firmware being out of range in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996, MSM8996AU, QCA6174A, QCA9377, QCA9379, SDM439, SDM636, SDM660, SDX20, SDX24, SM8150. plural Snapdragon The product contains a vulnerability in array index validation.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state

Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL after free/destroy of the object in Snapdragon Consumer IOT, Snapdragon Mobile in Kamorta, QCS605, Rennell, Saipan, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130. plural Snapdragon The product contains a vulnerability related to the use of freed memory.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state

u'During the error occurrence in capture request, the buffer is freed and later accessed causing the camera APP to fail due to memory use-after-free' in Snapdragon Consumer IOT, Snapdragon Mobile in Bitra, Kamorta, QCS605, Saipan, SDM710, SM8250, SXR2130

KingView (KingView) is the first industrial configuration software product launched by Asia Control in China. There is an information disclosure vulnerability in KingView, which can be exploited by attackers to obtain sensitive information.

Rockwell Automation (China) Co., Ltd. is a company engaged in industrial automation and information technology. A buffer overflow vulnerability exists in the ActiveX control of the Allen-Bradley control system, which an attacker can use to affect the confidentiality of the system.

KingView (KingView) is the first industrial configuration software product launched by Beijing Asia Control Technology Co., Ltd. in China. There is a DLL hijacking vulnerability in Kingview. An attacker can use the vulnerability to load a DLL file for command execution.

An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices. SWARCO CPU LS4000 Is the chip software built into the traffic light controller

Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read file that contains confidential data. An attacker could exploit this vulnerability to obtain files containing confidential data

KUNBUS-GW Modbus TCP is a programmable logic controller (PLC) that provides an integrated ControlNet communication port and provides two integrated Ethernet interfaces. KUNBUS-GW Modbus TCP has a denial of service vulnerability. Attackers can use vulnerabilities to bring equipment down.

KUNBUS-GW Modbus TCP is a programmable logic controller (PLC) that provides an integrated ControlNet communication port and provides two integrated Ethernet interfaces. KUNBUS-GW Modbus TCP has a denial of service vulnerability. Attackers can use vulnerabilities to bring equipment down.

KUNBUS-GW Modbus TCP is a programmable logic controller (PLC) that provides an integrated ControlNet communication port and provides two integrated Ethernet interfaces. KUNBUS-GW Modbus TCP has a denial of service vulnerability. Attackers can use vulnerabilities to bring equipment down.

Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R7800, R6220, R8000, R6350, R9000, R6400, RAX120, R6400v2, RBR20, R6800, XR300, R6850, XR500, and R7000P. NETGEAR R7000 is a wireless router of NETGEAR. Attackers can use this vulnerability to send malicious firmware updates to routers by implementing man-in-the-middle attacks

testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices. plural VIVOTEK Network Camera There is an information leakage vulnerability in.Information may be obtained

VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with resultant execution of OS commands). For example, this affects IT9388-HT devices. plural VIVOTEK Network Camera To OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state

A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, preventing subsequent print jobs until the printer is rebooted. Lenovo Printer LJ4010DN There is an input verification vulnerability in.Service operation interruption (DoS) It may be put into a state. Lenovo Printer LJ4010DN is a multi-function printer from Lenovo of China. There is a security hole in the Lenovo Printer LJ4010DN using firmware prior to version 1.01

A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is rebooted. Lenovo Printer LJ4010DN There is an input verification vulnerability in.Service operation interruption (DoS) It may be put into a state. Lenovo Printer LJ4010DN is a multi-function printer from Lenovo of China. There is a security hole in the Lenovo Printer LJ4010DN using firmware prior to version 1.01

HUAWEI Mate 10 smartphones with versions earlier than 10.0.0.143(C00E143R2P4) have an information disclosure vulnerability. The attacker could wake up voice assistant then do a series of crafted voice operation, successful exploit could allow the attacker read certain files without unlock the phone leading to information disclosure. Huawei Mate 10 is a smart phone of the Chinese company Huawei

There is a denial of service vulnerability in some Huawei products. Due to improper memory management, memory leakage may occur in some special cases. Attackers can perform a series of operations to exploit this vulnerability. Successful exploit may cause a denial of service. Affected product versions include: CloudEngine 12800 versions V200R019C00SPC800; CloudEngine 5800 versions V200R019C00SPC800; CloudEngine 6800 versions V200R005C20SPC800, V200R019C00SPC800; CloudEngine 7800 versions V200R019C00SPC800; NE40E versions V800R011C00SPC200, V800R011C00SPC300, V800R011C10SPC100; NE40E-F versions V800R011C00SPC200, V800R011C10SPC100; NE40E-M versions V800R011C00SPC200, V800R011C10SPC100. CloudEngine 12800 and 6800 Is vulnerable to a lack of resource release after a valid lifetime.Service operation interruption (DoS) It may be put into a state. Both Huawei CloudEngine 6800 and Huawei CloudEngine 12800 are products of the Chinese company Huawei. CloudEngine 6800 is a 6800 series 10 Gigabit Ethernet switch facing the data center. Huawei CloudEngine 12800 is a 12800 series data center switch. There is a security vulnerability in Huawei CloudEngine 12800 and CloudEngine 6800

HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.195(SP31C00E74R3P8) have an improper authorization vulnerability. The digital balance function does not sufficiently restrict the using time of certain user, successful exploit could allow the user break the limit of digital balance function after a series of operations with a PC. Huawei Mate 20 is a smart phone of the Chinese company Huawei. The vulnerability stems from the fact that the healthy use of mobile phone functions does not adequately limit the duration of user use. Attackers can use this vulnerability to break through the restrictions on the healthy use of mobile phone functions

E6878-370 products with versions of 10.0.3.1(H557SP27C233) and 10.0.3.1(H563SP1C00) have a stack buffer overflow vulnerability. The program copies an input buffer to an output buffer without verification. An attacker in the adjacent network could send a crafted message, successful exploit could lead to stack buffer overflow which may cause malicious code execution. E6878-370 Is vulnerable to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Huawei E6878-370 is a portable 5G router from China's Huawei company