CVE-2025-65291

Aqara Hub devices including Hub M2 4.3.60027, Hub M3 4.3.60025, Camera Hub G3 4.1.90027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring...

WAGO Indsutrial-Managed-Switches 安全漏洞

WAGO Indsutrial-Managed-Switches is a series of high-performance network devices from WAGO, Germany. A security vulnerability exists in WAGO Indsutrial-Managed-Switches, which stems from an unsafe sscanf call in the checkaccount function, which could lead to full control of the device...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-56400

A Cross-Site Request Forgery (CSRF) vulnerability exists in the OAuth implementation of the Tuya SDK version 6.5.0 for Android and iOS. This affects the Tuya Smart and Smartlife mobile applications, along with other third-party applications integrating the SDK. The root cause is a failure to vali...

The vulnerability of the KeeneticOS operating system, related to the failure to handle CRLF sequences properly, allows a hacker to execute arbitrary commands and gain full control over the device.

The vulnerability of the KeeneticOS operating system is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands and gain full control over the device...

Comet Browser Flaw Lets Hidden API Run Commands on Users’ Devices

SquareX warns Perplexity's Comet AI browser contains a hidden MCP API that bypasses security, allowing attackers to install malware and seize full device control...

CVE-2025-63219

The ITEL ISO FM SFN Adapter firmware ISO2 2.0.0.0, WebServer 2.0 is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An attacker can access an active session without authentication, allowing them to control the device, modify configurations, and...

CVE-2025-63219

The ITEL ISO FM SFN Adapter firmware ISO2 2.0.0.0, WebServer 2.0 is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An attacker can access an active session without authentication, allowing them to control the device, modify configurations, and...

CVE-2025-63219

The ITEL ISO FM SFN Adapter firmware ISO2 2.0.0.0, WebServer 2.0 is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An attacker can access an active session without authentication, allowing them to control the device, modify configurations, and...

Obscure MCP API in Comet Browser Breaches User Trust, Enabling Full Device Control via AI Browsers

Palo Alto, California, 19th November 2025, CyberNewsWire...

CVE-2025-63219

The ITEL ISO FM SFN Adapter (running firmware ISO2 2.0.0.0 and WebServer 2.0 ) is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An unauthenticated attacker can access an active session to gain control of the device, modify configurations, and compr...

CVE-2025-63219

The ITEL ISO FM SFN Adapter firmware ISO2 2.0.0.0, WebServer 2.0 is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An attacker can access an active session without authentication, allowing them to control the device, modify configurations, and...

Eurolab ELTS100_UBX 安全漏洞

The Eurolab ELTS100UBX is a network connectivity device from Eurolab Italy. A security vulnerability exists in the Eurolab ELTS100UBX ELTS100v1.UBX version, which stems from a lack of authentication of critical management endpoints and could lead to full device control...

Itel DAB MUX 安全漏洞

Itel DAB MUX is an encoding and multiplexing all-in-one device from Itel, Italy. A security vulnerability exists in the Itel DAB MUX build c041640a version, which stems from improper JWT authentication and could lead to authentication bypass and full device control...

METZ CONNECT多款产品 安全漏洞

METZ CONNECT Energy-Controlling EWIO2-M and others are products of METZ CONNECT, Germany.METZ CONNECT Energy-Controlling EWIO2-M is a high performance data logger.METZ CONNECT Energy- Controlling EWIO2-M-BM is a high performance data logger.METZ CONNECT Ethernet-IO EWIO2-BM is a sensor and actuat...

CVE-2025-29270

Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device...

EUVD-2025-37375

Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device...