RACOM M!DGE2 安全漏洞

RACOM M!DGE2 is a cellular network router from RACOM Czech Republic. A security vulnerability exists in RACOM M!DGE2 that originates from a non-primary administrator user being able to display the device configuration including the primary administrator's password, which could lead to elevated...

PT-2025-34793 · Ubiquiti · Ubiquiti Unifi

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A non-primary administrator user with admin rights to the web interface, but without shell access permissions, can view the device configuration, including the master admin password. This also allo...

CVE-2025-3456

On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protoc...

CVE-2025-3892

CVE-2025-3892 concerns Axis devices running ACAP; the issue allows elevated privileges when an Axis device is configured to allow unsigned ACAP applications and a malicious ACAP app is installed after user trickery. The CVSS details indicate LOCAL exploitation with HIGH privileges required, high ...

📄 Xorux XorMon-NG 1.8 Information Disclosure

Xorux XorMon-NG versions 1.8 and below has an API endpoint that should be limited to web application administrators. It is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information...

CVE-2025-54766 KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information...

Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information

Vulnerability Details Affected Vendor: Xorux Affected Product: XorMon-NG Affected Version: 1.8 and prior Platform: Debian CWE Classification: CWE-648: Incorrect Use of Privileged APIs CVE ID: CVE-2025-54766 2. Vulnerability Description An API endpoint that should be limited to web application...

CVE-2025-25270

An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations...

CVE-2025-25270

An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations...

CVE-2025-25270

An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations...

CVE-2025-25270

CVE-2025-25270 affects PHOENIX CONTACT CHARX SEC-3150, SEC-3100 and SEC-3050 devices. An unauthenticated, remote attacker can modify the device configuration to achieve remote code execution as root under specific configurations. The entry documents a network-attack surface with root-level impact...

PT-2025-28347 · Device · Device

Name of the Vulnerable Software and Affected Versions: Affected versions not specified Description: An unauthenticated remote attacker can alter the device configuration to achieve remote code execution as root with specific configurations. Recommendations: At the moment, there is no information...

CVE-2025-32879

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device...

PT-2025-26315 · Coros · Coros Pace 3

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions 3.0808.0 and earlier Description: An issue was discovered that allows an attacker to connect to the device via Bluetooth Low Energy BLE if no other device is connected. Once connected, the attacker can access the device'...

COROS PACE 3 安全漏洞

COROS PACE 3 is a GPS sports watch from COROS China. A security vulnerability exists in COROS PACE 3 3.0808.0 and prior versions, which stems from a failure to require authentication for BLE services, which could lead to tampering with the device configuration...

CVE-2025-32879

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device...

CVE-2022-49983

In the Linux kernel, the following vulnerability has been resolved: udmabuf: Set the DMA mask for the udmabuf device v2 If the DMA mask is not set explicitly, the following warning occurs when the userspace tries to access the dma-buf via the CPU as reported by syzbot here: WARNING: CPU: 1 PID:...

The vulnerability of the web application for the basic configuration of devices under Revolution Pi OS, specifically the Bullseye device, is related to deficiencies in the authentication process. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the web application for the basic configuration of devices under the Revolution Pi OS operating system, Bullseye, is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and...

The vulnerability of the Device Configuration component in the APIX application programming interface of the AXIS OS operating system allows a perpetrator to increase their privileges.

The vulnerability of the Device Configuration component in the APIX application programming interface of the AXIS OS operating system is related to incomplete filtering of specific elements. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

Unbreakable Enterprise kernel security update

5.15.0-309.180.4 - nvme: unblock ctrl state transition for firmware update Daniel Wagner - nfsd: decrease sccount directly if fail to queue dlrecall Li Lingfeng - cpufreq/sched: Fix the usage of CPUFREQNEEDUPDATELIMITS Rafael J. Wysocki - ice: Check VF VSI Pointer Value in icevcaddfdirfltr...