219 matches found
Google Teams Up with Ecosystem Partners to Enhance Security of SoC Processors
Google said it's working with ecosystem partners to harden the security of firmware that interacts with Android. While the Android operating system runs on what's called the application processor AP, it's just one of the many processors of a system-on-chip SoC that cater to various tasks like...
Google Teams Up with Ecosystem Partners to Enhance Security of SoC Processors
Google said it's working with ecosystem partners to harden the security of firmware that interacts with Android. While the Android operating system runs on what's called the application processor AP, it's just one of the many processors of a system-on-chip SoC that cater to various tasks like...
CVE-2023-24236
TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules...
CVE-2020-23588
CVE-2020-23588 affects OPTILINK OP-XT71000N hardware (Version V2.2) with firmware OP_V3.3.1-191028. An unauthenticated, remote attacker can perform a CSRF attack via /rmtacc.asp to enable/disable ports and to change port numbers. Impact: unauthorized configuration changes. The Red Hat advisory an...
Insyde InsydeH2O 缓冲区错误漏洞
Insyde InsydeH2O is a C source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O PcdSmmDxe, which arises from the vulnerability of...
CVE-2022-34152
Improper input validation in BIOS firmware for some IntelR NUC Boards, IntelR NUC Kits before version TY0070 may allow a privileged user to potentially enable escalation of privilege via local access...
Multiple race conditions due to TOCTOU flaws in various UEFI Implementations
Overview Multiple Unified Extensible Firmware Interface UEFI implementations are vulnerable to code execution in System Management Mode SMM by an attacker who gains administrative privileges on the local machine. An attacker can corrupt the memory using Direct Memory Access DMA timing attacks tha...
Intel(R) SSD DC 授权问题漏洞
IntelR SSD DC is an internal solid state drive from Intel Corporation USA. A security vulnerability exists in IntelR SSD DC Products that stems from improper authentication in its firmware that could allow an unauthenticated user to potentially escalate privileges through physical access...
PT-2022-25305 · American Megatrends · Ami Aptiov
Name of the Vulnerable Software and Affected Versions: AMI Aptio version 5.x Description: An attacker can exploit this issue to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than the operating system OS and completely...
Input validation
Improper initialization in the firmware for some IntelR NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable an escalation of privilege via local access...
Hardcoded credentials
Totolink A3600RFirmware V4.1.2cu.5182B20201102 contains a hard code password for root in /etc/shadow.sample...
CVE-2022-31206
The Omron SYSMAC Nx product family PLCs NJ series, NY series, NX series, and PMAC series through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software which compiles IEC 61131-3 conformant POU code to native machine code for execution...
CVE-2021-40597
The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password...
Critical 'Pantsdown' BMC Vulnerability Affects QCT Servers Used in Data Centers
Quanta Cloud Technology QCT servers have been identified as vulnerable to the severe "Pantsdown" Baseboard Management Controller BMC flaw, according to new research published today. "An attacker running code on a vulnerable QCT server would be able to 'hop' from the server host to the BMC and mov...
Input validation
Improper input validation in firmware for some IntelR NUCs may allow a privileged user to potentially enable escalation of privilege via local access...
CVE-2021-39298
A potential vulnerability in AMD System Management Mode SMM interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware...
coreboot 安全漏洞
coreboot is a freeware program. It is designed to replace the proprietary BIOS firmware found in most computers. A security vulnerability exists in coreboot 4.13 through 4.16, which originates on the AP and may occur as a result of arbitrary code execution in the SMM...
CVE-2021-46008
CVE-2021-46008 describes a hard-coded telnet password in TotoLink A3100R firmware version V5.9c.4577. Multiple sources (CNVD/CNNVD, CVE lists) confirm that the telnet password is built into the official firmware, enabling an attacker who is connected to Wi‑Fi to obtain a root shell via telnet if ...
New 16 High-Severity UEFI Firmware Flaws Discovered in Millions of HP Devices
Cybersecurity researchers on Tuesday disclosed 16 new high-severity vulnerabilities in various implementations of Unified Extensible Firmware Interface UEFI firmware impacting multiple HP enterprise devices. The shortcomings, which have CVSS scores ranging from 7.5 to 8.8, have been uncovered in...
