The vulnerability of the microprogrammed wireless access point software for Moxa AWK-3121 lies in insufficient validation of arguments passed in commands, allowing attackers to execute arbitrary commands with root privileges.

The vulnerability of the microprogrammed wireless access point software for Moxa AWK-3121 lies in insufficient verification of the arguments passed in the command. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges, using a specially crafted...

Linux Bug Opens Most VPNs to Hijacking

A vulnerability in most Linux distros has been uncovered that allows a network-adjacent attacker to hijack VPN connections and inject rogue data into the secure tunnels that victims are using to communicate with remote servers. According to researchers at University of New Mexico and Breakpointin...

Moxa AWK-3121

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits available Vendor: Moxa Equipment: AWK-3121 Vulnerabilities: Cleartext Transmission of Sensitive Information, Improper Access Control, Sensitive Cookie without ‘HTTPONLY’ Flag, Improper...

CVE-2019-15264 Cisco Aironet Access Points and Catalyst 9100 Access Points CAPWAP Denial of Service Vulnerability

A vulnerability in the Control and Provisioning of Wireless Access Points CAPWAP protocol implementation of Cisco Aironet and Catalyst 9100 Access Points APs could allow an unauthenticated, adjacent attacker to cause an affected device to restart unexpectedly, resulting in a denial of service DoS...

Rockwell Automation Stratix 5100 Wireless Access Point and Workgroup Bridge < 15.4 Reusing a Nonce (ICSA-17-299-02)

Binary data 720291.prm...

Zyxel NWA/NAP/WAC Hardcoded Credentials Vulnerability

An FTP service runs on the Zyxel wireless access point that contains the configuration file for the WiFi network. This FTP server can be accessed with hard-coded credentials that are embedded in the firmware of the AP. When the WiFi network is bound to another VLAN, an attacker can cross the...

D-Link 6600-AP and DWL-3600AP Buffer Overflow Vulnerability

The D-Link 6600-AP and the DWL-3600AP are both wireless access point devices from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the D-Link 6600-AP and DWL-3600AP. The vulnerability originates when a network system or product performs an operation on memory without properl...

Moxa AWK-3121 Buffer Overflow Vulnerability (CNVD-2019-17002)

Moxa AWK-3121 is an industrial-grade wireless access point from Moxa Taiwan, China. A buffer overflow vulnerability exists in Moxa AWK-3121 version 1.14, which can be exploited by an attacker to cause a buffer overflow or heap overflow, among others...

CVE-2018-4017

An exploitable vulnerability exists in the Wi-Fi Access Point feature of the Roav A1 Dashcam running version RoavA1SWV1.9. A set of default credentials can potentially be used to connect to the device. An attacker can connect to the AP to trigger this vulnerability...

WPA encryption problem vulnerability

WPA is a set of Wi-Fi access protection schemes from the Wi-Fi Alliance USA, including security protocols and security authentication procedures. There is a security vulnerability in WPA. An attacker can exploit the vulnerability to bypass security restrictions and perform unauthorized operations...

WPA Privilege Access Control Issue Vulnerability (CNVD-2019-14562)

WPA is a set of Wi-Fi access protection schemes from the Wi-Fi Alliance USA, including security protocols and security authentication procedures. There is a security vulnerability in the implementation of WPA. An attacker can exploit the vulnerability by using specially crafted submission...

RSA Conference 2019: BleedingBit Flaws Continue to Plague Firms

UPDATE SAN FRANCISCO – Mobile key platform UniKey has patched vulnerabilities related to the infamous BleedingBit attack in its platform. BleedingBit is an issue in Bluetooth Low-Energy chips made by Texas Instruments and used in millions of wireless access points, which was disclosed in November...

ALE Alcatel OmniAccess Wireless Access Point Information Disclosure Vulnerability

The ALE Alcatel OmniAccess Wireless Access Point is a wireless access point device from ALE France. A security vulnerability exists in the ALE Alcatel OmniAccess Wireless Access Point. An attacker can exploit the vulnerability by sending a specially crafted URL to view configuration commands...

ALE Alcatel OmniAccess Wireless Access Point Cross-Site Scripting Vulnerability

The ALE Alcatel OmniAccess Wireless Access Point is a wireless access point device from ALE France. A cross-site scripting vulnerability exists in the ALE Alcatel OmniAccess Wireless Access Pointh. A remote attacker can exploit this vulnerability by tricking an IAP administrator into clicking on ...

IoT: OFF by default

It’s increasingly difficult to buy home appliances and other tech that DOESN’T have connectivity. Despite reservations about the security of smart tech, if we want to buy mid to high end devices, we often have no choice but to buy appliances with connectivity. To quote @Mikko Hypponen: If it is...

Two Zero-Day Bugs Open Millions of Wireless Access Points to Attack

UPDATE Two zero-day vulnerabilities in Bluetooth Low-Energy chips made by Texas Instruments and used in millions of wireless access points open corporate networks to crippling stealth attacks. Adversaries can exploit the bugs by simply being approximately 100 to 300 feet from the vulnerable...

Cisco Wireless LAN Controller Denial of Service Vulnerability (CNVD-2018-21481)

Cisco Wireless LAN Controller WLC Software is a suite of software for configuring and managing WLCs Wireless LAN Controllers from Cisco.Control and Provisioning of Wireless Access Points CAPWAP is one of the wireless access point control and provisioning components. CAPWAP is one of the wireless...

Input validation

A vulnerability in the Control and Provisioning of Wireless Access Points CAPWAP protocol component of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper input validation on...

D-Link Patches RCE Bugs in Wireless Access Point Gear

Four vulnerabilities were disclosed in D-Link’s software controller tool used in its enterprise-class wireless network access points. The disclosure, made on Thursday, also included two vulnerabilities that enabled attackers to remotely execute code with system permissions. The flaws were...

The vulnerability of Watchguard’s wireless access points’ microprogramming software lies in the lack of sufficient file loading restrictions, allowing attackers to execute arbitrary commands.

The vulnerability of the microprogrammed software of Watchguard wireless access points relates to insufficient restrictions on file downloads. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary commands...