CVE-2018-20100

An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect during configuration allows attackers to discover home Wi-Fi credentials. This data transfer uses an unencrypted access point for these credentials, and passes them in an HTTP POST,...

Design/Logic Flaw

An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect during configuration allows attackers to discover home Wi-Fi credentials. This data transfer uses an unencrypted access point for these credentials, and passes them in an HTTP POST,...

Guardzilla Home Cameras Open to Anyone Wanting to Watch Their Footage

Another day, another internet of things IoT issue: A design flaw in the Guardzilla home video surveillance system has been discovered that allows users to watch other homeowners’ Guardzilla videos. The Guardzilla All-In-One Video Security System is a home security platform that provides indoor...

CVE-2018-11741

NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...

Smart speakers: Christmas treat or lump of coal?

Christmas is nearly upon us, and thoughts are perhaps turning to various digital presents of a “smart” nature. Home security, hubs, speakers, cameras, and mashups of all of those and more besides. With regards to speakers, the most immediate pieces of your home are theoretically at your beck and...

Amazon sent 1,700 audio recordings of Alexa user to a stranger

By Waqas An Amazon customer in Germany under the European Union data protection law called GDPR General Data Protection Regulation requested the company to send all the data it stored on him but little did he know he was about to get his hands on a trove of 1,700 audio recordings of a stranger...

Veeam Availability Console U1 Cumulative Patch 1913

Challenge Veeam Availability Console U1 Cumulative Patch 1913. This update supersedes Veeam Availability Console U1 Cumulative Patch 1850. Cause Please confirm you are running version 2.0.2.1750 or later prior to installing this cumulative patch 1913. You can check this under Windows Programs and...

TOSHIBA Home Gateway HEM-GW26A and TOSHIBA Home Gateway HEM-GW16A Access Control Error Vulnerabilities

TOSHIBA Home Gateway HEM-GW26A and TOSHIBA Home Gateway HEM-GW16A are both home gateway products from Toshiba Japan. An access control error vulnerability exists in TOSHIBA Home Gateway HEM-GW26A version 1.2.9 and earlier and TOSHIBA Home Gateway version 1.2.9 and earlier, which can be exploited ...

TOSHIBA Home Gateway HEM-GW26A and TOSHIBA Home Gateway HEM-GW16A Cross-Site Scripting Vulnerabilities

TOSHIBA Home Gateway HEM-GW26A and TOSHIBA Home Gateway HEM-GW16A are both home gateway products from Toshiba Japan. A cross-site scripting vulnerability exists in TOSHIBA Home Gateway HEM-GW26A version 1.2.9 and earlier and TOSHIBA Home HEM-GW16A version 1.2.9 and earlier, which can be exploited...

TOSHIBA Home Gateway HEM-GW26A and TOSHIBA Home Gateway HEM-GW16A Operating System Command Injection Vulnerability

TOSHIBA Home Gateway HEM-GW26A and TOSHIBA Home Gateway HEM-GW16A are both home gateway products from Toshiba Japan. An operating system command injection vulnerability exists in TOSHIBA Home Gateway HEM-GW26A version 1.2.9 and earlier and TOSHIBA Home Gateway HEM-GW16A version 1.2.9 and earlier,...

CVE-2018-20299

An issue was discovered in several Bosch Smart Home cameras 360 degree indoor camera and Eyes outdoor camera with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow ...

CVE-2018-20299

An issue was discovered in several Bosch Smart Home cameras 360 degree indoor camera and Eyes outdoor camera with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow ...

Buffer overflow

An issue was discovered in several Bosch Smart Home cameras 360 degree indoor camera and Eyes outdoor camera with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow ...

CVE-2018-20299

The CVE affects Bosch Smart Home cameras (360° indoor and Eyes outdoor) with firmware prior to 6.52.4. A buffer overflow in the web server’s RCP+ parser allows a remote attacker over the network to potentially achieve unauthorized code execution on the device. The vulnerability has a network atta...

CVE-2018-20299

An issue was discovered in several Bosch Smart Home cameras 360 degree indoor camera and Eyes outdoor camera with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow ...

GPON ONT Home Gateway Router Detection

Binary data gponrouterdetect.nbin...

GPON ONT Home Gateway Router is vulnerable to authentication bypass (CVE-2018-10561)

Binary data gponcve-2018-10561.nbin...

JVN#99810718: Multiple vulnerabilities in Toshiba Lighting & Technology Corporation Home gateway

Home gateway provided by Toshiba Lighting & Technology Corporation contains multiple vulnerabilities listed below. Improper access control CWE-284 - CVE-2018-16197 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L| Base Score: 6.3 CVSS v2|...

CVE-2018-20161

A design flaw in the BlinkForHome aka Blink For Home Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips triggered by the motion sensor are not saved if the attacker's traffic such as Dot11Deauth successfully disconnects the Sync Module from the...

CVE-2018-20161

A design flaw in the BlinkForHome aka Blink For Home Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips triggered by the motion sensor are not saved if the attacker's traffic such as Dot11Deauth successfully disconnects the Sync Module from the...