4400 matches found
CVE-2025-52545
E3 Site Supervisor Control firmware version 2.31F01 RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services...
CVE-2025-52543
E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...
CVE-2025-52549
CVE-2025-52549 affects Copeland/E3 Site Supervisor Control. Vulnerable firmware versions prior to 2.31F01 generate a root Linux password on each boot, enabling an attacker to derive the root password from known or easily obtainable parameters. Impacts include full device compromise with root acce...
CVE-2025-52549 Predictable root linux password generation
E3 Site Supervisor Control firmware version 2.31F01 generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters...
CVE-2025-52548 Enabling SSH and Shellinabox on the vulnerable machine
E3 Site Supervisor Control firmware version 2.31F01 contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the...
CVE-2025-52545 Privilege escalation in the application services
E3 Site Supervisor Control firmware version 2.31F01 RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services...
CVE-2025-52545
The CVE-2025-52545 entry describes the E3 Site Supervisor Control RCI service (firmware
CVE-2025-52544
CVE-2025-52544 affects Copeland/ E3 Site Supervisor Control firmware versions before 2.31F01. A floor plan feature permits an unauthenticated attacker to upload floor plan files, which can be used to read arbitrary files from the E3 file system. Documented impact indicates potential arbitrary fil...
CVE-2025-52543 Login to the application services using only the password hash
E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...
CVE-2025-6519
CVE-2025-6519 overview (confirmed details) : Affects Copeland E3 Site Supervisor firmware versions prior to 2.31F01. The vulnerability stems from a default admin account named “ONEDAY” that uses a daily-generated password which can be predicted. The ONEDAY user cannot be deleted or modified by an...
kernel: scsi: lpfc: Use memcpy() for BIOS version
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy for BIOS version The strlcat with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset with...
CVE-2024-48705
Wavlink AC1200 with firmware versions M32A3V1410230602 and M32A3V1410240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "setsysadm" function of the "adm.cgi" binary, and is due to improper santization ...
CVE-2025-9783
A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423. This issue affects the function sub418030 of the file /boafrm/formParentControl. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly...
PT-2025-35506
Name of the Vulnerable Software and Affected Versions: Tenda AC20 version 16.03.08.05 Description: A stack-based buffer overflow exists due to the manipulation of the wanMTU argument in the file /goform/fromAdvSetMacMtuWan. Remote exploitation is possible. The exploit has been made publicly...
CVE-2025-29515
Incorrect access control in the DELTfile.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password...
CVE-2025-29522
D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping function...
CVE-2025-57220
An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09multiTDE01 to escalate privileges to root via a crafted UDP packet...
CVE-2025-9443
A flaw has been found in Tenda CH22 1.0.0.1. This vulnerability affects the function formeditUserName of the file /goform/editUserName. Executing manipulation of the argument newaccount can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and m...
