169 matches found
TOTOLINK CP900 security vulnerabilities
The TOTOLINK CP900 is a wireless router. The TOTOLINK CP900 suffers from a buffer overflow vulnerability that stems from improper handling of the File parameter in the UploadCustomModule function of the file /cgi-bin/cstecgi.cgi. An attacker can use this vulnerability to cause a crash of the...
CVE-2024-7205
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information...
CVE-2024-7205 sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary user
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information...
CVE-2024-7205: Insertion of Sensitive Information Into Sent Data
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information...
TOTOLINK A3700R Command Injection Vulnerability
TOTOLINK A3700R is a wireless router, launched by TOTOLINK China Gion Electronics, a Taiwan-based networking equipment manufacturer. The TOTOLINK A3700R suffers from a command injection vulnerability located in the /cgi-bin/cstecgi.cgi file, which stems from improper handling of the hostName...
Juniper Routers Auth Bypass Flaw Leads to Complete Device Takeover
...
Critical F5 Central Manager Vulnerabilities Allow Enable Full Device Takeover
Two security vulnerabilities have been discovered in F5 Next Central Manager that could be exploited by a threat actor to seize control of the devices and create hidden rogue administrator accounts for persistence. The remotely exploitable flaws "can give attackers full administrative control of...
Fake Chrome Updates Hide Android Brokewell Malware Targeting Your Bank
By Deeba Ahmed New Android malware alert! Brokewell steals data, takes over devices & targets your bank. Learn how this sneaky malware works & what you can do to protect yourself. Stop Brokewell before it stops you! This is a post from HackRead.com Read the original post: Fake Chrome Updates Hide...
Malicious code in accessibletrap (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8474de211a93f6609827bb3a4e63a05cba1f2124131efd6a9ddf34edb2f89ed3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2023-24052
An issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via the change password functionality as it does not prompt for the current password...
Researchers Find 34 Windows Drivers Vulnerable to Full Device Takeover
As many as 34 unique vulnerable Windows Driver Model WDM and Windows Driver Frameworks WDF drivers could be exploited by non-privileged threat actors to gain full control of the devices and execute arbitrary code on the underlying systems. "By exploiting the drivers, an attacker without privilege...
MOXA NPort 5000 Series Security Breach
The MOXA NPort 5000 Series is a series of general-purpose device servers from China-based MOXA. A security vulnerability exists in the MOXA NPort 5000 Series that stems from insufficient checking for firmware updates or upgrades, allowing an attacker to manipulate the firmware and take control of...
CVE-2023-43634: Insufficiently Protected Credentials
When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config partition that was mapped to PCR 13. I...
CVE-2023-33375
Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices...
Anatsa Banking Trojan Targeting Users in US, UK, Germany, Austria, and Switzerland
A new Android malware campaign has been observed pushing the Anatsa banking trojan to target banking customers in the U.S., U.K., Germany, Austria, and Switzerland since the start of March 2023. "The actors behind Anatsa aim to steal credentials used to authorize customers in mobile banking...
CVE-2022-4333
Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over the device. These accounts should be deactivated according to Sprecher's hardening guidelines...
CVE-2022-4333 Sprecher: Sprecon maintenance access with hardcoded credentials
Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over the device. These accounts should be deactivated according to Sprecher's hardening guidelines...
CVE-2022-4333
CVE-2022-4333 concerns Sprecher Automation SPRECON-E CPU variants with hardcoded credentials that enable a remote attacker to take over the device. Multiple connected sources (Red Hat advisory, Tenable OT plugin, CVE records, and vendor/PT/security databases) consistently describe a vulnerability...
CVE-2022-4333 Sprecher: Sprecon maintenance access with hardcoded credentials
Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over the device. These accounts should be deactivated according to Sprecher's hardening guidelines...
CVE-2022-4333: Use of Hard-coded Credentials
Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over the device. These accounts should be deactivated according to Sprecher's hardening guidelines...