787 matches found
CVE-2026-101954
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web...
CVE-2026-101954
Juniper Networks Junos OS and Junos OS Evolved are affected by an Improper Authentication vulnerability (CWE-287) in the J-Web management interface and its NETCONF session handling . An unauthenticated network attacker can exploit a reachable J-Web HTTP or HTTPS service to obtain root-level devic...
EUVD-2026-101337
Lantronix XPress-DR and XPress-DR-I CoBos-family firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718...
cs4239-cve-2020-15873
CVE-2020-15873 Proof of Concept of CVE-2020-15873 - Blind SQL Injection in Librenms librenms librenms Development Debugging LibreNMS Docker Instance 1. Obtain a shell to the container: $ sudo docker exec -it librenmsvuln /bin/bash 2. To read the logs generated by LibreNMS: $ tail -f...
CVE-2018-18441-exploit
CVE-2018-18441-exploit Las cámaras Wi-Fi de la serie DCS de D-Link exponen información sensible sobre la configuración del dispositivo. Los dispositivos afectados incluyen muchas de la serie DCS, como: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L,...
CVE-2026-104076
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...
EUVD-2026-95251
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers...
CVE-2026-102294: Improper Neutralization of Special Elements used in an OS Command
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...
CVE-2026-90184: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...
CVE-2026-73125 Ebyte NA111-M Missing Authentication for Critical Function
Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability...
CVE-2026-73125
Ebyte NE2-D11 devices are affected by a missing authentication flaw in the web management interface . The interface does not consistently enforce authentication before granting access to administrative functionality, allowing an unauthenticated remote attacker to read sensitive configuration data...
FURUNO ELECTRIC FA-50 CLASS B AIS TRANSPONDER uses hard-coded credentials and misses authentication for additional configuration
Overview FA-50 CLASS B AIS TRANSPONDER provided by FURUNO ELECTRIC CO., LTD. contains the following vulnerabilities. Use of hard-coded credentials CWE-798 - CVE-2026-59769 The CVSS evaluation above assumes that an attacker who knows the credentials and has access to the network to which the devic...
Ebyte NE2-D11
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized administrative access, disclose sensitive information, modify device configuration, hijack authenticated sessions, and disrupt device operation. 2. RECOMMENDED PRACTICES CISA recommends...
CVE-2026-13196 Out-of-bounds Write in KUNBUS piControl
Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the...
PT-2026-72031
Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the...
CVE-2026-15141
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an...
CVE-2026-6181
The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...
EUVD-2026-55962
The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...
CVE-2026-6181
The CVE-2026-6181 entry concerns the Device Configuration Framework. Vulnerability: authentication bypass achievable after an attacker authenticates with a viewer-privileged service account. Root cause: flawed auth logic permitting bypass once logged in with a high-privilege viewer account. Impac...