CVE-2021-46008

CVE-2021-46008 describes a hard-coded telnet password in TotoLink A3100R firmware version V5.9c.4577. Multiple sources (CNVD/CNNVD, CVE lists) confirm that the telnet password is built into the official firmware, enabling an attacker who is connected to Wi‑Fi to obtain a root shell via telnet if ...

New 16 High-Severity UEFI Firmware Flaws Discovered in Millions of HP Devices

Cybersecurity researchers on Tuesday disclosed 16 new high-severity vulnerabilities in various implementations of Unified Extensible Firmware Interface UEFI firmware impacting multiple HP enterprise devices. The shortcomings, which have CVSS scores ranging from 7.5 to 8.8, have been uncovered in...

PT-2022-10273

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O Kernel 5.x Description An issue was discovered in Insyde InsydeH2O, affecting HddPassword, where software SMI services using the Communicate function of the EFI SMM COMMUNICATION PROTOCOL do not validate the buffer address,...

Read-Only LDAP Authentication Bypass Vulnerability in Lenovo XClarity Controller (XCC) Firmware - Lenovo Support US

No description provided...

A Well-Meaning Feature Leaves Millions of Dell PCs Vulnerable

Flaws in a firmware security tool affect as many as 30 million desktops, laptops, and tablets...

CVE-2020-12360

Out of bounds read in the firmware for some IntelR Processors may allow an authenticated user to potentially enable escalation of privilege via local access...

OESA-2021-1192 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Integer overflow in DxeImageVerificationHandler EDK II may allow an authenticated user to potentially enable denial of service via local access.CVE-2019-14562...

Important: linux-firmware security, bug fix, and enhancement update

The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fixes: kernel: Integer overflow in IntelR Graphics Drivers CVE-2020-12362 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

CVE-2021-20709

Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker with an administrative privilege to execute arbitrary OS commands by...

CVE-2021-28203

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary...

CVE-2021-26892

Windows Extensible Firmware Interface Security Feature Bypass Vulnerability...

Important: Red Hat Security Advisory: linux-firmware security and bug fix update

An update for linux-firmware is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2020-13799

Western Digital has identified a security vulnerability in the Replay Protected Memory Block RPMB protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol is specified by industry standards bodies and is implemente...

Input validation

Improper input validation in the firmware for IntelR Server Board S2600ST and S2600WF families may allow a privileged user to potentially enable escalation of privilege via local access...

Intel Adds Memory Encryption, Firmware Security to Ice Lake Chips

Intel’s third-generation Xeon Scalable server processors, code-named Ice Lake, will be rolled out with new security upgrades that the chip giant claims will better protect devices from firmware attacks. The upcoming chips are based on Ice Lake, Intel’s 10nm CPU microarchitecture, which was first...

EulerOS Virtualization for ARM 64 3.0.2.0 : edk2 (EulerOS-SA-2020-1988)

According to the versions of the edk2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - EFI Development Kit II AARCH64 UEFI Firmware Security Fixes:No description is available for this CVE.CVE-2019-14586No...

Intel BIOS Advisory

Summary: Potential security vulnerabilities in BIOS firmware for multiple Intel Platforms may allow escalation of privilege, denial of service and/or information disclosure. Intel is releasing BIOS updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2020-8672...

CVE-2020-10278

The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged by a Malicious operator to boot from a Live Image...

VMware Carbon Black and Dell Extend Endpoint Security Below the OS

As endpoint security continues to evolve and thwart legacy attack techniques, cyber criminals are always trying to stay one step ahead to avoid detection and gain a persistent foothold in their targets’ infrastructure. Some sophisticated attackers are gaining traction through the malicious...

Opto 22 SoftPAC Project

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Opto 22 Equipment: SoftPAC Project Vulnerabilities: External Control of File Name or Path, Improper Verification of Cryptographic Signature, Improper Access Control, Uncontrolled Search Path...