CVE-2025-51643

The Meitrack T366G-L GPS Tracker (confirmed firmware T366L_Y24H131V039 ) is vulnerable because its Winbond 25Q64JVSIQ SPI flash chip lacks authentication and tamper protection. An attacker with physical access can use a standard SPI programmer and flashrom to extract the firmware, leading to the ...

CVE-2025-51643: Exposure of Sensitive Information to an Unauthorized Actor

Meitrack T366G-L GPS Tracker devices contain an SPI flash chip Winbond 25Q64JVSIQ that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of...

CVE-2025-51643

Meitrack T366G-L GPS Tracker devices contain an SPI flash chip Winbond 25Q64JVSIQ that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of...

CVE-2025-54465

This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve the hard-coded MQTT...

CVE-2025-54464 Cleartext Storage Vulnerability in ZKTeco WL20

This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials...

CVE-2025-54464

The CVE-2025-54464 entry concerns ZKTeco WL20. The vulnerability is described as cleartext storage of admin and user credentials within the device firmware. An attacker with physical access could extract the firmware, reverse‑engineer the binary data, and obtain unencrypted credentials, impacting...

CVE-2025-54464 Cleartext Storage Vulnerability in ZKTeco WL20

This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials...

CVE-2025-53758 Default Credential Vulnerability in Digisol DG-GR6821AC Router

This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management interface. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the hardcoded default...

CVE-2025-53755 Cleartext Storage Vulnerability in Digisol DG-GR6821AC Router

This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted dat...

CVE-2025-53755

CVE-2025-53755 affects Digisol DG-GR6821AC Router. The vulnerability stems from credentials and PINs stored unencrypted in the device firmware. An attacker with physical access could extract the firmware and reverse‑engineer the binary data to read unencrypted credentials, potentially gaining una...

PT-2025-29773 · Digisol · Digisol Dg-Gr6821Ac Router

Name of the Vulnerable Software and Affected Versions: Digisol DG-GR6821AC Router affected versions not specified Description: The Digisol DG-GR6821AC Router stores credentials and PINS without encryption in the device firmware. An attacker with physical access could extract the firmware and...

PT-2025-29821 · Digisol · Digisol Dg-Gr6821Ac Router

Name of the Vulnerable Software and Affected Versions: Digisol DG-GR6821AC Router affected versions not specified Description: The Digisol DG-GR6821AC Router is susceptible to unauthorized access due to the use of default admin credentials at its web management interface. An attacker with physica...

CVE-2024-41689

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext WP...

CVE-2020-29323

The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data...

CVE-2025-3442

The CVE-2025-3442 case concerns TP-Link Tapo H200 V1 IoT Smart Hub. Affected component: device firmware storing Wi‑Fi credentials in plaintext. Root cause: credentials are stored unencrypted within the firmware binary, enabling disclosure if the firmware is extracted. Impact: attacker with physic...

CVE-2025-2189

This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable...

CVE-2025-2189 Information Disclosure Vulnerability in Tinxy Smart Devices

This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable...

CVE-2025-2189

The CVE-2025-2189 entry concerns Tinxy smart devices where credentials are stored in plaintext within the device firmware. The vulnerability can be exploited by an attacker with physical access who can extract the firmware and inspect the binary data to obtain plaintext credentials. Documents con...

PT-2025-10747

Name of the Vulnerable Software and Affected Versions Tinxy smart devices affected versions not specified Description The issue exists due to the storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and...

CVE-2025-26408

The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. This enables an attacker to extract information, modify and debug the device's firmware. All known versions are affected...