PT-2018-12720

Name of the Vulnerable Software and Affected Versions Becton, Dickinson and Company BD Alaris Plus medical syringe pumps models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA versions prior to 2.3.7 Description The issue is related to an improper authentication mechanism where the software fail...

CVE-2018-14786: Improper Authentication

Becton, Dickinson and Company BD Alaris Plus medical syringe pumps models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA versions 2.3.6 and prior are affected by an improper authentication vulnerability where the software does not perform authentication for functionality that requires a provabl...

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Remote Root

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Remote Root Exploit Vendor: Microhard Systems Inc. Product web page: http://www.microhardcorp.com Affected version: IPn4G 1.1.0 build 1098 IPn3Gb 2.2.0 build 2160 IPn4Gb 1.1.6 build 1184-14 IPn4Gb 1.1.0 Rev 2 build 1090-2 IPn4Gb 1.1.0 R...

Momentum Axel 720P Root Account Vulnerability

The Momentum Axel 720P is a dual-band HD camera that supports WiFi connectivity. A security vulnerability exists in Momentum Axel 720P version 5.1.8. The vulnerability can be exploited by an attacker to gain root privileges with the help of a UART pin code to take full control of the system...

Zyxel Multy X (AC3000 Tri-Band WiFi System) Device Backdoor Vulnerability

The Zyxel Multy X AC3000 Tri-Band WiFi System device is a wireless networking kit from Hopkins ZyXEL Technologies. A security vulnerability exists in the Zyxel Multy X AC3000 Tri-Band WiFi System device, which arises from the program failing to use the correct mechanism to protect the UART.An...

MECO USB Memory Stick Privilege Gain Vulnerability

MECO USB Memory Stick is a portable USB memory device. A security vulnerability exists in the MECO USB Memory Stick with Fingerprint MECOZiolsamDE601. An attacker can exploit the vulnerability by sending static packets to the serial port on the PCB to unlock the key and gain access to the data...

CVE-2017-16242: Improper Authentication

An issue was discovered on MECO USB Memory Stick with Fingerprint MECOZiolsamDE601 devices. The fingerprint authentication requirement for data access can be bypassed. An attacker with physical access can send a static packet to a serial port exposed on the PCB to unlock the key and get access to...

PT-2018-6259

Name of the Vulnerable Software and Affected Versions: MECO USB Memory Stick with Fingerprint MECOZiolsamDE601 Description: An issue allows the fingerprint authentication requirement for data access to be bypassed. With physical access, an attacker can send a static packet to a serial port expose...

Fuzzing and Data Manipulation Framework: Fuddly

Among the variety of complementary approaches used in the security evaluation of a target e.g. , software, an embedded equipment, etc. , fuzz testing—abbreviated fuzzing —is widely recognized as an effective means to help discovering security weaknesses in a target. Fuzzing is a software testing...

iBaby M3S Pre-installed Account Access

The vulnerability of the microprogrammed software of the iBaby M3S wireless video camera is related to the presence of a pre-set administrator account “admin”. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the device with administrator privileges via...

CVE-2017-8156

The outdoor unit of Customer Premise Equipment CPE product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port. An attacker can access the serial port on the circuit board of the outdoor unit and log in to the CPE without authentication. Successful exploit could allow t...

CVE-2017-8156

The outdoor unit of Customer Premise Equipment CPE product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port. An attacker can access the serial port on the circuit board of the outdoor unit and log in to the CPE without authentication. Successful exploit could allow t...

Authentication flaw

The outdoor unit of Customer Premise Equipment CPE product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port. An attacker can access the serial port on the circuit board of the outdoor unit and log in to the CPE without authentication. Successful exploit could allow t...

CVE-2017-8156

The outdoor unit of Customer Premise Equipment CPE product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port. An attacker can access the serial port on the circuit board of the outdoor unit and log in to the CPE without authentication. Successful exploit could allow t...

CVE-2017-8156

CVE-2017-8156 is a no-authentication serial-port vulnerability in Huawei CPE outdoor unit B2338-168 V100R001C00. The issue allows an attacker with physical access to log in to the device via the serial console and take control of the outdoor unit. The Huawei PSIRT advisory confirms two related vu...

PT-2017-18164

Name of the Vulnerable Software and Affected Versions B2338-168 version V100R001C00 Description The issue affects the outdoor unit of the CPE product, where a lack of authentication on the serial port allows an attacker to access the unit without authentication. This could enable the attacker to...

CVE-2017-8156: Missing Authentication for Critical Function

The outdoor unit of Customer Premise Equipment CPE product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port. An attacker can access the serial port on the circuit board of the outdoor unit and log in to the CPE without authentication. Successful exploit could allow t...

Authentication flaw

Huawei UAP2105 before V300R012C00SPC160BootRom does not require authentication to the serial port or the VxWorks shell...

CVE-2015-6592

Huawei UAP2105 before V300R012C00SPC160BootRom does not require authentication to the serial port or the VxWorks shell...

CVE-2015-6592

CVE-2015-6592 affects Huawei UAP2105 prior to V300R012C00SPC160 (BootROM). The issue is unauthenticated access to the serial port and the VxWorks shell, allowing an attacker to run VxWorks debugging commands and view/modify memory and files, leading to information disclosure and system anomalies....