CVE-2025-54810

CVE-2025-54810 affects Cognex In-Sight Explorer and In-Sight Camera Firmware. A proprietary protocol on TCP port 1069 handles management operations, including changing system properties. User management data (usernames and passwords) are transmitted over an unencrypted channel, enabling an adjace...

PT-2025-87: Incorrect session expiration in Fastwel PLC web server

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 CPM810-03, 3.4.9.1 СPM723-01. The discovered vulnerability can be exploited by an attacker to gain unlimited access to a device by brute-forcing or compromising a session token. Vulnerability status: Confirmed ...

CVE-2025-9696 Use of Hard-coded Credentials in SunPower PVS6

The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the...

SunPower PVS6

RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to gain full access to the device, enabling them to replace firmware, modify settings, disable the device, create SSH tunnels, and manipulate attached devices. 2. RECOMMENDED PRACTICES CISA recommends users take...

Mitsubishi Electric MELSEC iQ-F Series CPU Module

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker the ability to obtain credential information by intercepting SLMP communication messages, and read or write the device values of the product by using the obtained credential information. In addition, the...

CVE-2025-41689

CVE-2025-41689 affects Wiesemann & Theis Motherbox 3, a measurement data centralization device. The vulnerability allows an unauthenticated remote attacker to access stored measurement data with read-only rights due to an access-control weakness. Impact per CVSS v3.1 is High (Network, no privileg...

CVE-2025-7770

Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID...

Packet Power EMX and EG

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain full access to the device without authentication. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimizing...

CVE-2025-20696

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09915215;...

CVE-2025-41687

An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected devices...

The vulnerability of the user interface of Juniper Networks Junos OS allows a hacker to gain access to the device.

The vulnerability of the user interface of Juniper Networks Junos OS is related to discrepancies in the data of the user interface. Exploiting this vulnerability can allow a malicious actor to gain access to the device remotely...

CVE-2025-41668

A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device...

CVE-2025-41666

A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized...

CVE-2025-41668

CVE-2025-41668 describes a file-replacement vulnerability affecting Phoenix Contact devices (notably AXC F 1152 and related products). An attacker with low privilege and remote file access can replace a critical file or folder used by the service security-profile, enabling read, write and execute...

CVE-2025-41667

Phoenix Contact devices (e.g., AXC F 1152 and related products) are listed under CVE-2025-41667. A low-privileged remote attacker with file access can replace a critical file used by the arp-preinit script, enabling read, write, and execute access to arbitrary files on the device. Impact is descr...

CVE-2025-53168

Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this vulnerability may allow the peer device to use the camera without user awareness...

CVE-2024-43085

In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...

CVE-2023-0757

Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR SDK allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device...

CVE-2023-44097

Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-27964

An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 5E133. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source...