CVE-2018-15721

CVE-2018-15721 affects Logitech Harmony Hub, where the XMPP server before 4.15.206 allows authentication bypass via a crafted XMPP request, enabling remote, unauthenticated access to the device’s local API. Connected sources confirm the vulnerability enables full control of the hub, with attacker...

CVE-2018-15721: Improper Authentication

The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use this vulnerability to gain access to the local API...

CVE-2018-15722: Improper Neutralization of Special Elements used in an OS Command

The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can inject OS commands with a properly formatted response...

CVE-2018-15720: Use of Hard-coded Credentials

Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API...

CVE-2018-15723: Origin Validation Error

The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands e.g. harmony.system?systeminfo...

PT-2018-13170

Name of the Vulnerable Software and Affected Versions Logitech Harmony Hub versions prior to 4.15.206 Description The issue concerns hard-coded accounts in the XMPP server, allowing remote users to access the local API. Recommendations For versions prior to 4.15.206, update to version 4.15.206 or...

PT-2018-13172

Name of the Vulnerable Software and Affected Versions Logitech Harmony Hub versions prior to 4.15.206 Description The issue allows for OS command injection via the time update request. A remote server or man in the middle can inject OS commands with a properly formatted response. Recommendations...

PT-2018-13173

Name of the Vulnerable Software and Affected Versions Logitech Harmony Hub versions prior to 4.15.206 Description The issue allows an unauthenticated remote attacker to execute application-defined commands via crafted HTTP requests, potentially leveraging the "harmony.system?systeminfo" endpoint...

PT-2018-13171

Name of the Vulnerable Software and Affected Versions Logitech Harmony Hub versions prior to 4.15.206 Description The issue concerns an authentication bypass vulnerability in the XMPP server of the Logitech Harmony Hub. This vulnerability can be exploited by remote attackers using a crafted XMPP...

Logitech Options < 7.10.3 Remote Command Execution Vulnerability - Windows

Logitech Options is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Logitech Keystroke Injection Flaw Went Unaddressed for Months

Computer peripheral giant Logitech has finally issued a patched version of its Logitech Options desktop app, after being taken to task for a months-old security flaw. The bug could have allowed adversaries to launch keystroke injection attacks against Logitech keyboard owners that used the app...

Logitech Options Detection (Windows SMB Login)

SMB login-based detection of Logitech Options. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Logitech SqueezeCenter/Media Server CLI Detection

The script tries to identify services supporting Logitech SqueezeCenter/Media Server CLI interface. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

partner.logitech.com XSS vulnerability

Open Bug Bounty ID: OBB-682027 Description| Value ---|--- Affected Website:| partner.logitech.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

alert.logitech.com XSS vulnerability

Open Bug Bounty ID: OBB-682026 Description| Value ---|--- Affected Website:| alert.logitech.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...

PT-2018-2013

Name of the Vulnerable Software and Affected Versions Logitech Options affected versions not specified Description The issue is related to the lack of authentication attempt limits in the Logitech Options utility's WebSocket server. This could allow a remote attacker to execute arbitrary commands...

LOGICOOL CONNECTION UTILITY SOFTWARE Untrusted Search Path Vulnerability

LOGICOOL CONNECTION UTILITY SOFTWARE is a suite of software from the Swedish company LOGICOOL for restoring the connection of Logitech devices to non-Unifying wireless receivers. An untrusted search path vulnerability exists in LOGICOOL CONNECTION UTILITY SOFTWARE versions prior to 2.30.9, which...

CVE-2018-0621

Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

meeting.logitech.com XSS vulnerability

Open Bug Bounty ID: OBB-635135 Description| Value ---|--- Affected Website:| meeting.logitech.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

partner.logitech.com XSS vulnerability

Open Bug Bounty ID: OBB-635134 Description| Value ---|--- Affected Website:| partner.logitech.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...