1881 matches found
PT-2023-5846
Name of the Vulnerable Software and Affected Versions Connected IO versions 2.1.0 and prior Description The issue is related to an argument injection vulnerability in the AT command message of the communication protocol, allowing attackers to execute arbitrary OS commands on devices. This...
Connected IO Operating System Command Injection Vulnerability
Connected IO is a leading hardware, software and cloud-based IoT and machine-to-machine solution from US-based Connected IO, Inc. A security vulnerability exists in Connected IO ER2000 v2.1.0 and earlier versions, which stems from a command injection vulnerability in the set firewall command in t...
CVE-2023-33377: Improper Neutralization of Special Elements used in an OS Command
Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary OS commands on devices...
CVE-2023-33373
Connected IO CVE-2023-33373 affects v2.1.0 and earlier, where passwords and credentials are stored in clear-text, enabling credential exfiltration and device impersonation. Impact is credential leakage with total compromise potential; exploitation is described conceptually, with no explicit in-wi...
CVE-2023-33374
Connected IO v2.1.0 and earlier are vulnerable due to a command in the communication protocol that allows the management platform to specify arbitrary OS commands for devices to execute, causing arbitrary remote command execution. Affected component: the device communication protocol in Connected...
CVE-2023-33375
CVE-2023-33375 affects Connected IO ER2000 edge routers (v2.1.0 and earlier). The vulnerability is a stack-based buffer overflow in the device’s communication protocol that enables an attacker to take control of the device. Documented impact is high (CVE score 9.8; Confidentiality/Integrity/Avail...
Connected IO Security Vulnerability
Connected IO is a leading hardware, software and cloud-based IoT and machine-to-machine solution from US-based Connected IO, Inc. A security vulnerability exists in Connected IO prior to version v2.1.0 that stems from a misconfiguration in the MQTT agent used for management and device communicati...
PT-2023-5845 · Unknown · Connected Io
Name of the Vulnerable Software and Affected Versions: Connected IO versions 2.1.0 and prior Description: The issue is related to a stack-based buffer overflow vulnerability in the communication protocol of the affected software. This vulnerability enables attackers to take control over devices...
CVE-2023-33373
Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices...
CVE-2023-33376
CVE-2023-33376 affects Connected IO ER2000 edge routers (v2.1.0 and prior). Root cause: argument injection in the iptables command message within the device’s communication protocol. Impact: attackers can remotely execute arbitrary OS commands on affected devices. CVSSv3.1 base score 9.8 (CRITICA...
CVE-2023-33377
CVE-2023-33377 affects Connected IO ER2000 edge routers v2.1.0 and prior. The vulnerability is an OS command injection in the “set firewall” command within the device’s communication protocol, enabling an attacker to execute arbitrary OS commands on the device. NVD/Red Hat/CNNVD references consis...
CVE-2023-33372
Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacker who gained access to these credentials is able to connect to the MQTT broker and send messages on behalf of devices, impersonating them...
PT-2023-5758 · Unknown · Connected Io
Name of the Vulnerable Software and Affected Versions: Connected IO versions 2.1.0 and prior Description: The issue is related to an argument injection vulnerability in the iptables command message of the communication protocol. This vulnerability enables attackers to execute arbitrary OS command...
Vulnerabilities exposed Peloton treadmills to malware and DoS attacks
By Habiba Rashid Internet-Connected Gym Equipment Raises Concerns Over Security Vulnerabilities! This is a post from HackRead.com Read the original post: Vulnerabilities exposed Peloton treadmills to malware and DoS attacks...
The vulnerability of the Connected User Experiences and Telemetry operating system service allows attackers to enhance their privileges.
The vulnerability of the Connected User Experiences and Telemetry services in the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of Connected User Experiences and Telemetry Services for Windows operating systems allows attackers to execute processes with elevated privileges.
The vulnerability of Connected User Experiences and Telemetry Services in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to execute processes with elevated privileges through a specially created application...
Cisco Multiple Vulnerabilities in NX-OS-Based Products (CVE-2014-3261)
Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System 1.4 before 1.41i, NX-OS 5.0 before 5.03U22 on Nexus 3000 devices, NX-OS 4.1 before 4.12E11l on Nexus 4000 devices, NX-OS 5.x before 5.13N11 on Nexus 5000 devices, NX-OS 5...
kernel: net/ulp: use-after-free in listening ULP sockets
A use-after-free flaw was found in the Linux kernel’s TLS protocol functionality in how a user installs a tls context struct tlscontext on a connected TCP socket. This flaw allows a local user to crash or potentially escalate their privileges on the system...
WordPress Connected Sermons Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)
Software Connected Sermons Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c3e345f223ee Credits Rafie Muhammad Patchstack Requir...
