CVE-2026-1122-IoT-Firmware-Update-Signature-Bypass-via-Low-Order-Point-Injection

5. CVE-2026-1122 – Bypass de firma de actualización de firmware IoT mediante inyección de punto de orden bajo Resumen La verificación de firmware OTA de un dispositivo IoT utiliza una implementación Ed25519 defectuosa que no rechaza claves públicas con componentes de orden pequeño, lo que permite...

CVE-2025-65855

CVE-2025-65855 Múltiples vulnerabilidades en la actualización OTA de HelpFlash IoT Resumen Múltiples vulnerabilidades en el mecanismo de actualización de firmware OTA de Netun Solutions HelpFlash IoT permiten a un atacante con acceso físico breve ejecutar código arbitrario. ID de CVE:...

CVE-2026-100613 capgo.app Authorization Bypass via Stale Channel Permission Overrides

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

CVE-2026-11810

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-9397

A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Update Installation Handler. This manipulation causes improper authorization. The attack is possible to be carried out remotely. A high degree...

CVE-2026-9397: Improper Authorization

A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Update Installation Handler. This manipulation causes improper authorization. The attack is possible to be carried out remotely. A high degree...

CVE-2025-44018

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2025-44018

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2025-44018

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

GL-Inet GL-AXT1800 OTA Update firmware downgrade vulnerability

Talos Vulnerability Report TALOS-2025-2230 GL-Inet GL-AXT1800 OTA Update firmware downgrade vulnerability November 24, 2025 CVE Number CVE-2025-44018 SUMMARY A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can le...

CVE-2025-44018: Improper Certificate Validation

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

EUVD-2023-46319

Malicious code in bioql PyPI...

EUVD-2021-9138

Malicious code in bioql PyPI...

EUVD-2021-9133

Malicious code in bioql PyPI...

CVE-2023-41827

An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI...

CVE-2021-21962

A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of specially-crafted MQTT payloads can lead to remote code execution. An attacker must perform a man-in-the-middle attack in order to trigger th...

CVE-2023-41827

An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI...

Input validation

An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI...

CVE-2023-41827

An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI...

CVE-2023-41827: Improper Export of Android Application Components

An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI...