CVE-2023-40709 Uncontrolled Resource Consumption in OPTO 22 SNAP PAC S1 Built-In Web Server

An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b...

CVE-2023-40709

An explicit technical detail from multiple sources confirms CVE-2023-40709 affects the OPTO 22 SNAP PAC S1 built-in web server when firmware version R10.3b is installed. The vulnerability is described as Uncontrolled Resource Consumption: an adversary can crash the entire device by sending a larg...

OPTO 22 SNAP PAC S1 资源管理错误漏洞

The OPTO 22 SNAP PAC S1 is a controller from OPTO 22 USA. A security vulnerability exists in the OPTO 22 SNAP PAC S1 R10.3b firmware version, which stems from If the controller has the built-in web server enabled, but the built-in web server is not fully setup and configured, an attacker exploiti...

DNS monitor LAST RESPONSE "Failure - ICMP port unreachable"

DNS type monitor LAST RESPONSE displayed"Failure - ICMP port unreachable" like below:...

CVE-2023-40709: Allocation of Resources Without Limits or Throttling

An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b...

Moxa AWK-3121 Improper Neutralization of Special Elements Used in a Command (CVE-2018-10697)

An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST paramet...

CVE-2023-34101

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the daoinputstoring function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes...

Out-of-bounds

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the daoinputstoring function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes...

CVE-2023-34101

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the "daoinputstoring" function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 byte...

CVE-2023-34101 Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the daoinputstoring function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes...

CVE-2023-34101 Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the daoinputstoring function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes...

CVE-2023-34101

CVE-2023-34101 affects Contiki-NG prior to 4.9. In processing ICMP DAO packets, the function dao_input_storing may read up to 16 bytes beyond the buffer due to not verifying buffer size, causing an out-of-bounds read. An attacker can truncate ICMP packets to trigger this. A patch is available in ...

CVE-2023-34101: Out-of-bounds Read

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the daoinputstoring function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes...

New PowerDrop Malware Targeting U.S. Aerospace Industry

An unknown threat actor has been observed targeting the U.S. aerospace industry with a new PowerShell-based malware called PowerDrop. "PowerDrop uses advanced techniques to evade detection such as deception, encoding, and encryption," according to Adlumin, which found the malware implanted in an...

ntopng:fuzz_dissect_packet: Heap-buffer-overflow in ICMPinfo::dissectICMP

Project: https://github.com/ntop/ntopng.git Detailed Report: https://oss-fuzz.com/testcase?key=5417493917990912 Project: ntopng Fuzzing Engine: afl Fuzz Target: fuzzdissectpacket Job Type: aflasanntopng Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x604000018bc0 Crash...

kernel: icmp: Fix data-races around sysctl.

A flaw was found in the Linux kernel's ICMP protocol. A race condition can occur when reading the ICMP sysctl variables due to a missing lock, potentially impacting system stability and resulting in a denial of service...

kernel: icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.

A flaw was found in the Linux kernel's ICMP protocol. A race condition can occur when reading the sysctlicmperrorsuseinboundifaddr resource due to a missing lock, potentially impacting system stability and resulting in a denial of service...

PT-2025-8571

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data-race issue exists in the Linux kernel related to icmp sysctl variables. When reading these variables, they can be changed concurrently, which can lead to data-races. To address...

Chinese Hackers Spotted Using Linux Variant of PingPull in Targeted Cyberattacks

The Chinese nation-state group dubbed Alloy Taurus is using a Linux variant of a backdoor called PingPull as well as a new undocumented tool codenamed Sword2033. That's according to findings from Palo Alto Networks Unit 42, which discovered recent malicious cyber activity carried out by the group...

Chinese Hackers Spotted Using Linux Variant of PingPull in Targeted Cyberattacks

The Chinese nation-state group dubbed Alloy Taurus is using a Linux variant of a backdoor called PingPull as well as a new undocumented tool codenamed Sword2033. That's according to findings from Palo Alto Networks Unit 42, which discovered recent malicious cyber activity carried out by the group...