RondoDox Botnet Exploits Flaws in TBK DVRs and Four-Faith Routers to Launch DDoS Attacks

Cybersecurity researchers are calling attention to a malware campaign that's targeting security flaws in TBK digital video recorders DVRs and Four-Faith routers to rope the devices into a new botnet called RondoDox. The vulnerabilities in question include CVE-2024-3721, a medium-severity command...

CVE-2025-41222

CVE-2025-41222 impacts a broad set of Siemens RUGGEDCOM devices (e.g., i800/i801/i802/i803, M2100/M2200, RP110, RS… series, RSG… series, RSL/REST, RST) and stems from improper handling of malformed TLS handshake messages. The result is a network-accessible DoS that can crash the web server and th...

PT-2025-28352 · Phoenix Contact · Axc F 1152 +4

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device...

CVE-2025-38182

In the Linux kernel, the following vulnerability has been resolved: ublk: santizize the arguments from userspace when adding a device Sanity check the values for queue depth and number of queues we get from userspace when adding a device...

CVE-2025-34052

The CVE concerns AVTECH IP cameras, DVRs, and NVRs where an unauthenticated request to Machine.cgi?action=get_capability exposes internal device details (firmware version, MAC address, supported codecs). This is an unauthenticated information-disclosure issue, enabling fingerprinting/Discovery bu...

CVE-2025-6562

Certain hybrid DVR models HBF-09KD and HBF-16NK from Hunt Electronic have an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary OS commands and execute them on the device...

Autel MaxiCharger AC Wallbox Commercial Code Execution Vulnerability

Autel MaxiCharger AC Wallbox Commercial is a smart AI electric car charger from Autel USA. A code execution vulnerability exists in Autel MaxiCharger AC Wallbox Commercial, which can be exploited by an attacker to execute arbitrary code in the context of the device...

TrendMakers Sight Bulb Pro

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to capture sensitive information and execute arbitrary shell commands on the target device as root if connected to the local network segment. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform...

Xiaomi Mi Connect Service APP 授权问题漏洞

Xiaomi Mi Connect Service APP is an application from China's Xiaomi Xiaomi that is used to enable connectivity and interaction between Xiaomi devices, which helps users to quickly connect and manage a variety of Xiaomi smart devices to enable data transfer and collaborative work between devices. ...

How to Protect Yourself From Phone Searches at the US Border

Customs and Border Protection has broad authority to search travelers’ devices when they cross into the United States. Here’s what you can do to protect your digital life while at the US border...

PT-2025-25246 · Autel · Autel Maxicharger Ac Wallbox Commercial

Name of the Vulnerable Software and Affected Versions: Autel MaxiCharger AC Wallbox Commercial affected versions not specified Description: The issue concerns a misinterpretation of input in the ble process esp32 msg function. No information is provided about the estimated number of potentially...

CVE-2025-49599

Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow the Epuser account to disable ONT firewall functionality, e.g., to remove the default blocking of the SSH and TELNET TCP ports, aka HWNO-56Q3...

PT-2025-23466 · Wago · Fully Managed Switches 0852-0303 +12

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A low-privileged attacker can set the device's date to January 19th, 2038, exceeding the 32-bit time limit. This causes the device's date to be set back to January 1st, 1970. Recommendations...

CVE-2024-13947

Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.; NEXUS Series: through 3.; MATRIX Series: through 3...

CVE-2025-27803

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access ...

CVE-2024-43778

OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings...

CVE-2024-53701

Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc. Under certain conditions, and when an attacker can directly operate the device which its screen is unlocked by a user, the provided securit...

CVE-2024-40851

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker with physical access may be able to access contact photos from the lock screen...

CVE-2023-47867

MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device...

CVE-2023-49237

An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings...