CVE-2022-23972

ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database...

CVE-2022-26269

Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages...

Suzuki Connect 安全漏洞

Suzuki Connect is a web-based solution from Suzuki Japan. It is used to obtain vehicle information such as fuel, ignition status, current position, seat buckle status, and more. A security vulnerability exists in Suzuki Connect v1.0.15 that allows an attacker to tamper with displayed messages by...

WEKA INTEREST Security Scanner 安全漏洞

WEKA INTEREST Security Scanner is a commonly used software for data exploration by the University of Waikato team in New Zealand. A security vulnerability exists in WEKA INTEREST Security Scanner version 1.8 LAN Viewer, which results in a denial of service when unknown input is used in certain...

CVE-2022-27082

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo...

The vulnerability of the NT Lan Manager Datagram Receiver Driver of the Microsoft Windows operating system allows a hacker to disclose protected information.

The vulnerability of the NT Lan Manager Datagram Receiver Driver of the Microsoft Windows operating system is related to the disclosure of information. Exploiting this vulnerability can allow an attacker to disclose protected information...

CVE-2022-26999

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wanipstat, wanmaskstat, wangwstat, and wandns1stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

.A flaw was found in the CAN BCM networking protocol in the Linux kernel where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.

...

CVE-2022-25218

The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetdstartup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's...

CVE-2022-25217

Use of a hard-coded cryptographic key pair by the telnetdstartup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetdstartup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware...

CVE-2022-25215

Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add or remove client MAC addresses to or from a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself...

CVE-2022-25214

Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated...

Hardcoded credentials

Use of a hard-coded cryptographic key pair by the telnetdstartup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetdstartup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware...

CVE-2022-25218

The CVE-2022-25218 entry concerns PHICOMM router devices (e.g., K2, K3, K3C) where telnetd_startup uses RSA without OAEP or padding. An unauthenticated attacker on the LAN can craft UDP packets to influence the OpenSSL RSA_public_decrypt() processing, manipulating the telnetd startup state machin...

CVE-2022-25217

Use of a hard-coded cryptographic key pair by the telnetdstartup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetdstartup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware...

CVE-2022-25217

CVE-2022-25217 involves hard-coded RSA keys in telnetd_startup on Phicomm/K2 and K3C firmware. A local attacker within the LAN can obtain a root shell by leveraging the leaked private key to trigger telnetd_startup via scripted UDP exchanges, spawning an unauthenticated root telnet shell. Concret...

CVE-2022-25214

CVE-2022-25214 affects PHICOMM K2/K3 family routers where LocalClientList.asp and wirelesssetup.asp improperly enforce access control. An unauthenticated remote attacker can read LAN device details (IP/MAC) and WPA passphrases for 2.4/5.0 GHz networks, with particular risk if the setup wizard reu...

PT-2022-17153 · Phicomm · K2 Firmware +1

Name of the Vulnerable Software and Affected Versions: No specific software or version information is provided. Description: The issue concerns improper access control on certain interfaces, allowing an unauthenticated remote attacker to obtain sensitive information. This includes data about...

PT-2022-17154 · Phicomm · K2 Firmware +1

Name of the Vulnerable Software and Affected Versions: No specific software or version information is provided. Description: The issue concerns improper access control on the LocalMACConfig.asp interface. This allows an unauthenticated remote attacker to modify a list of banned hosts by adding or...

DEBIAN-CVE-2021-3609

.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root...