CVE-2025-0360

CVE-2025-0360 affects Axis VAPIX Device Configuration framework; flaw could yield an incorrect privilege level for the VAPIX service account D-Bus API. Reported during a penetration test, the CVSSv3.1 vector indicates Local attacker, Low privileges required, No user interaction, with Confidential...

CVE-2025-0360

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API...

CVE-2025-0360

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a contention between nbdallocconfig and module removal, which could lead to resource consumption and null...

Lexmark 安全漏洞

Lexmark is a line of printers from Lexmark, a US-based company. A security vulnerability exists in Lexmark that stems from susceptibility to a cross-site request forgery attack that allows an attacker to modify the device configuration...

CVE-2020-10095

CVE-2020-10095 affects Lexmark devices (printers) with a CSRF vulnerability in the embedded web server that allows an attacker to modify the device configuration. The root cause is CSRF enabling unauthorized configuration changes, as described across multiple vendors/security feeds. Impact is the...

CVE-2020-10095

Various Lexmark devices have CSRF that allows an attacker to modify the configuration of the device...

CVE-2024-35341

Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFile.ini or /config.xml URIs. This configuration file contains usernames and encrypted passwords encrypted with a hardcoded key common to all devices. This...

CVE-2025-0675

CVE-2025-0675 affects Elber products (Elber Communications Equipment). The public records describe an authentication bypass that enables unauthorized access to password management, effectively allowing attackers to overwrite any user password and gain access to protected areas of affected devices...

CVE-2024-0568

CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communication...

CVE-2024-38420

CVE-2024-38420 is a memory corruption vulnerability affecting Qualcomm chipsets during configuration of a Hypervisor-based input virtual device. Connected sources confirm this is tied to a local attack surface (attack vector: LOCAL) with low privileges required and no user interaction, and they r...

CVE-2024-35277

A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the configuration of the managed devices by sending...

Siemens RUGGEDCOM ROX II Cross-Site Request Forgery (CVE-2020-28398)

The CLI feature in the web interface of affected devices is vulnerable to cross-site request forgery CSRF. This could allow an attacker to read or modify the device configuration by tricking an authenticated legitimate user into accessing a malicious link. This plugin only works with Tenable.ot...

Siemens RUGGEDCOM ROX II Cross-Site Request Forgery Vulnerability

RUGGEDCOM ROX II is a ROX-based VPN endpoint and firewall device for connecting devices operating in harsh environments, such as power substations and traffic control cabinets. A cross-site request forgery vulnerability exists in the Siemens RUGGEDCOM ROX II, which can be exploited by an attacker...

CVE-2020-28398

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...

CVE-2020-28398

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...

Siemens RUGGEDCOM 安全漏洞

RUGGEDCOM ROX II is a ROX-based VPN endpoint and firewall device for connecting devices operating in harsh environments, such as power substations and traffic control cabinets. A cross-site request forgery vulnerability exists in the Siemens RUGGEDCOM ROX II, which can be exploited by an attacker...

CVE-2024-35244

Sharp MFPs (Sharp Multifunction Printers) are affected by CVE-2024-35244 due to trust‑management issues that allow use of hard‑coded or easily obtainable credentials via maintenance accounts. Affected functionality can be abused to re‑configure devices, with risk to confidentiality and integrity ...

CVE-2024-50252 mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumipip: Fix memory leak when changing remote IPv6 address The device stores IPv6 addresses that are used for encapsulation in linear memory that is managed by the driver. Changing the remote address of an ip6gre net...

Helmholz REX100 安全漏洞

The Helmholz REX100 is a wireless router from Helmholz. A security vulnerability exists in Helmholz REX100 versions prior to 2.3.1, which originates from the ability of an unauthenticated, local attacker to decrypt the device configuration file...