Android Security Bulletin—May 2023Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2023-05-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

CVE-2023-23149

DEK-1705 =Firmware:34.23.1 device was discovered to have a command execution vulnerability...

The vulnerability of the SetVirtualServerSettings function in D-Link DIR-867 router microprogramming software allows a hacker to execute arbitrary commands in the device’s operating system under the identity of the root user.

The vulnerability of the SetVirtualServerSettings function in D-Link DIR-867 router microprogramming software is related to the possibility of executing commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the device’s operating system under the identi...

Exploit for Forced Browsing in Tenda F3_Firmware

CVE-2020-35391 Tenda f3 Malformed HTTP Request Header Processi...

SUSE CVE-2022-2347

There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download...

USN-5764-1 u-boot vulnerabilities

It was discovered that U-Boot incorrectly handled certain USB DFU download setup packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2022-2347 Nicolas Bidron and Nicolas Guigo discovered that U-Boot...

PT-2022-24914 · Microsoft · Azure Rtos Usbx

Name of the Vulnerable Software and Affected Versions: Azure RTOS USBX versions prior to 6.1.12 Description: The USB DFU UPLOAD functionality in Azure RTOS USBX may be utilized to introduce a buffer overflow, resulting in the overwrite of memory contents. In particular cases, this may allow an...

DEBIAN-CVE-2022-2347

There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download...

DENX Software Engineering Das U-Boot 缓冲区错误漏洞

DENX Software Engineering Das U-Boot is a Universal Bootloader from DENX Software Engineering, Germany. A security vulnerability exists in DENX Software Engineering Das U-Boot that originates from an unchecked download size and direction in the USB DFU, which can be exploited by an attacker to...

CVE-2022-29519

Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware...

CVE-2022-29246 Potential buffer overflow in function DFU upload in Azure RTOS USBX

Azure RTOS USBX is a USB host, device, and on-the-go OTG embedded stack. Prior to version 6.1.11, he USBX DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features o...

CVE-2021-32934 ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information

The affected ThroughTek P2P products SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module do not sufficiently protect data...

The vulnerability of Huawei FLMG-10 Bluetooth speakers’ microprogramming software, related to authentication mechanisms that lack sufficient protection, allows attackers to gain full control over the device.

The vulnerability of Huawei FLMG-10 Bluetooth speakers’ microprogramming software is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow attackers to gain full control over the device by loading specially created malware files...

Binatone Motorola-branded Camera Access Control Error Vulnerability

The Binatone Motorola-branded Camera is a Binatone licensed Motorola-branded camera from Binatone, Inc. The vulnerability can be exploited by an attacker on the same network to access the administration page, which can lead to information disclosure or update the device firmware with validated...

Improper access control

An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the same network as the device to access administrative pages that could result in information disclosure or device firmware update with verified...

Android Security Bulletin—September 2021Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2021-09-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Android Security Bulletin—August 2021Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2021-08-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

fwupd security update

An update is available for fwupd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fwupd packages provide a service that allows session software to update...

CVE-2021-26797

An access control vulnerability in Hame SD1 Wi-Fi firmware =V.20140224154640 allows an attacker to get system administrator through an open Telnet service...

Android Automotive OS Update Bulletin—April 2021Stay organized with collectionsSave and categorize content based on your preferences.

The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2021-04-01 or later from the April 2021 Android Security Bulletin in addition to all issues in this...