The vulnerability in the web interface of the Moxa MXView software control device allows a hacker to gain full access to the device.

The vulnerability of the Moxa MXView network control software web interface is related to the use of strictly encrypted login credentials. Exploiting this vulnerability allows a malicious actor to gain full access to the device by sending a specially crafted HTTP request...

The vulnerability of the microprogrammed software of Moxa’s EDR-G903, EDR-G902, and EDR-810 series of industrial routers lies in the use of rigidly encrypted account data, allowing attackers to gain full access to the devices.

The vulnerability of the microprogrammed software of Moxa’s EDR-G903, EDR-G902, and EDR-810 series of routers lies in the use of rigidly encrypted login credentials. Exploiting this vulnerability allows a malicious actor to gain full access to the device using these specially created login...

The vulnerability of microprogrammed software in programmable logic controllers SIMATIC S7-1200 and S7-1500 is related to insufficient protection of registration data, allowing attackers to gain full access to the device.

The vulnerability of microprogrammed software in programmable logic controllers SIMATIC S7-1200 and S7-1500 is related to insufficient protection of registration data. Exploiting this vulnerability can allow an intruder to gain full access to the device...

CVE-2022-28814 Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access

Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device...

CVE-2022-28814 Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access

Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device...

CVE-2022-22522

CVE-2022-22522 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server 2.8.3, where a remote, unauthenticated attacker could exploit hard-coded credentials to gain full access to the device. The vulnerability is described as trust/credential management issues enabling authentication bypass and full ...

CVE-2022-38970

ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs UIDs for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability flaw that allows remote attackers to establish direct connections to arbitrary...

PT-2022-24628 · Iegeek · Iegeek Ig20 Hipcam Realserver

Name of the Vulnerable Software and Affected Versions: ieGeek IG20 hipcam RealServer version V1.0 Description: The algorithm used to generate device IDs UIDs for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability flaw, allowing remote attackers to establish direc...

The vulnerability of the /ptippage.cgi component of the ISnex HC-IP9100HD and ISnex HC-IP9050HD network camera microprogramming system allows a intruder to gain full access to the device.

The vulnerability of the /ptippage.cgi component of the ISnex HC-IP9100HD and ISnex HC-IP9050HD network camera microprogramming system is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain ful...

CVE-2022-2634

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

Design/Logic Flaw

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

CVE-2022-2634 Digi ConnectPort X2D

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

CVE-2022-2634 Digi ConnectPort X2D

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

CVE-2022-2634

The CVE-2022-2634 entry maps to Digi ConnectPort X2D Gateway vulnerabilities where the web application lacks device access protections and permissions, allowing an attacker to upload Python files that can be executed. Concrete details from connected sources indicate affected products are Digi Con...

The vulnerability of the DA50N network switch web interface allows a hacker to gain full access to the device.

The vulnerability of the DA50N network switch web interface is related to weak password requirements. Exploiting this vulnerability can allow a remote attacker to gain full access to the device...

The vulnerability of the AuthToken component in the microprogramming software for Desigo DXR2, PXC3, PXC4, and PXC5 modules allows a hacker to gain access to the device by intercepting the authentication token.

The vulnerability of the AuthToken component in the microprogramming software for Desigo DXR2, PXC3, PXC4, and PXC5 modules is related to an incorrect expiration time of the session. Exploiting this vulnerability can allow attackers to gain access to the device by intercepting the authentication...

CVE-2022-30716

Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device...

CVE-2022-31486

An authenticated attacker can send a specially crafted route to the “editroute.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303...

Design/Logic Flaw

An authenticated attacker can send a specially crafted route to the “editroute.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303...

Authentication flaw

Keep My Notes v1.80.147 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation...