CVE-2025-27026

CVE-2025-27026 affects Infinera G42 version R6.1.3. A missing double‑check feature in the WebGUI CLI deactivation allows an authenticated administrator to disable multiple management interfaces across local and network access. The WebGUI‑driven CLI deactivation not only stops the CLI but also dea...

CVE-2025-27026 Improper Access Control Granularity impacting Infinera G42

A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but...

LB-LINK Router WebGetVar Function Heap Buffer Overflow

The vulnerability of the websGetVar function in the /goform/setblacklist file of the LB-LINK router microprogramming system exists due to the lack of measures to neutralize special elements used in the operating system command. Exploiting this vulnerability can allow a remote attacker to gain ful...

LB-LINK system websGetVar function Heap Buffer Overflow Privilege Escalation

The vulnerability of the websGetVar function in the /goform/setmanpwd file of the LB-LINK microprogramming system exists due to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability can allow a malicious actor, operating...

UBUNTU-CVE-2025-38053

In the Linux kernel, the following vulnerability has been resolved: idpf: fix null-ptr-deref in idpffeaturescheck idpffeaturescheck is used to validate the TX packet. skb header length is compared with the hardware supported value received from the device control plane. The value is stored in the...

CVE-2024-45263

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control...

CVE-2024-44171

This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, watchOS 11. An attacker with physical access to a locked device may be able to Control Nearby Devices via accessibility features...

CVE-2023-0773

The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerabili...

CVE-2023-5500

This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code 'Code Injection' to gain full control of the affected device...

CVE-2023-4929

All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the firmware and gain control of devices...

CVE-2023-33375

Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices...

CVE-2023-24048

Cross Site Request Forgery CSRF vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /manpassword.htm...

CVE-2023-1677

A vulnerability was found in DriverGenius 9.70.0.346. It has been rated as problematic. Affected by this issue is the function 0x9c40a0c8/0x9c40a0dc/0x9c40a0e0/0x9c40a0d8/0x9c4060d4/0x9c402004/0x9c402088/0x9c40208c/0x9c4060d0/0x9c4060cc/0x9c4060c4/0x9c402084 in the library mydrivers64.sys of the...

CVE-2022-22259

There is an improper authentication vulnerability in FLMG-10 10.0.1.0H100SP22C00. Successful exploitation of this vulnerability may lead to a control of the victim device...

CVE-2021-21959

A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality...

CVE-2020-11921

An issue was discovered in Lush 2 through 2020-02-25. Due to the lack of Bluetooth traffic encryption, it is possible to hijack an ongoing Bluetooth connection between the Lush 2 and a mobile phone. This allows an attacker to gain full control over the device...

CVE-2019-19824

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through...

CVE-2019-19194

The Bluetooth Low Energy Secure Manager Protocol SMP implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices installs a zero long term key LTK if an out-of-order link-layer encryption request...

CVE-2017-16948

TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service NULL pointer dereference or possibly have unspecified other impact via a NULL value in a 0x82730008 DeviceIoControl request to \\.\Viragtlt...

router Administrator Panel Privilege Escalation

The vulnerability of the administrator panel of microprogrammed software routers such as GL-A1300, GL-AX1800, GL-AXT1800, GL-MT3000, GL-MT2500, GL-MT6000, GL-MT1300, GL-MT300N-V2, GL-AR750S, GL-AR750, GL-AR300M, and GL-B1300 is related to deficiencies in authentication procedures. Exploiting this...