29540 matches found
Design/Logic Flaw
A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality...
Information disclosure
An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this...
Arbitrary file deletion
A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...
Out-of-bounds
An out-of-bounds write vulnerability exists in the URLdecode functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to an out-of-bounds write. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...
CVE-2021-21962
A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of specially-crafted MQTT payloads can lead to remote code execution. An attacker must perform a man-in-the-middle attack in order to trigger th...
CVE-2021-21962
A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of specially-crafted MQTT payloads can lead to remote code execution. An attacker must perform a man-in-the-middle attack in order to trigger th...
CVE-2021-21962
The provided connected documents confirm a heap-based buffer overflow in SeaConnect 370W (v1.3.34) OTA Update u-download, triggered by specially crafted MQTT payloads over a MITM position. The root cause involves the ParseToDownloadMessage path where unescape allocates a small heap buffer and une...
CVE-2021-21968
A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...
CVE-2021-21968
A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...
CVE-2021-21968
CVE-2021-21968 affects Sealevel Systems SeaConnect 370W v1.3.34. The OTA update task allows a specially crafted MQTT payload to overwrite arbitrary files due to improper input validation in the OTA download logic (notably the dest field can create/open any file). This can enable a MITM attacker t...
CVE-2021-21959
A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality...
CVE-2021-21959
A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality...
CVE-2021-21959
Sealevel Systems SeaConnect 370W v1.3.34 contains a misconfiguration in MQTTS where certificate validation is skipped, enabling MITM. The TALOS analysis sources the issue to improper certificate validation (CWE-295) in the MQTTS handshake, with the code paths GetConnected and NetworkConnectTLS sh...
CVE-2021-21963
An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this...
CVE-2021-21971
An out-of-bounds write vulnerability exists in the URLdecode functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to an out-of-bounds write. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...
CVE-2021-21963
The CVE-2021-21963 issue affects Sealevel Systems SeaConnect 370W v1.3.34 Web Server. The root cause is lack of encryption on the web server, allowing information disclosure via MITM attacks because the device uses HTTP Basic Authentication over HTTP (no TLS/HTTPS support in the SimpleLink-based ...
CVE-2021-21968: Improper Input Validation
A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...
CVE-2021-21971: Out-of-bounds Write
An out-of-bounds write vulnerability exists in the URLdecode functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to an out-of-bounds write. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...
CVE-2021-21963: Missing Encryption of Sensitive Data
An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this...
PT-2022-9213
Name of the Vulnerable Software and Affected Versions Sealevel Systems, Inc. SeaConnect 370W version 1.3.34 Description A misconfiguration in the MQTTS functionality simplifies a man-in-the-middle attack, allowing control of device functionality. Recommendations For version 1.3.34, consider...