Command injection

Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'donglebridge' program used to expose the functionalities of the ClickShare Button to a USB host, is vulnerable to OS command injection vulnerabilities. These vulnerabilities could lead to code...

CVE-2019-18830

Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'donglebridge' program used to expose the functionalities of the ClickShare Button to a USB host, is vulnerable to OS command injection vulnerabilities. These vulnerabilities could lead to code...

Google Will Award $1M-Plus to People Who Can Hack Titan M Security Chip

Google is willing to award up to $1.5 million to hackers who can successfully hack its Titan M security chip on the company’s Pixel devices as part of an expansion of its Android bug-bounty program unveiled this week. The company revealed increased payouts to its Android Security Rewards in a blo...

Homemade TEMPEST Receiver

Tom's Guide writes about home brew TEMPEST receivers: Today, dirt-cheap technology and free software make it possible for ordinary citizens to run their own Tempest programs and listen to what their own -- and their neighbors' -- electronic devices are doing. Elliott, a researcher at Boston-based...

On the IoT road: perks, benefits and security of moving smartly

Kaspersky has repeatedly investigated security issues related to IoT technologies for instance, here, or here. Earlier this year our experts have even gained foothold in the security of biomechanical prosthetic devices. The same implies to smart car security: our own research has indicated that...

Inateck 2.4 GHz Wireless Presenter WP1001 Keystroke Injection Vulnerability

Product: 2.4 GHz Wireless Presenter WP1001 Manufacturer: Inateck Affected Versions: Rev. v1.3C Tested Versions: Rev. v1.3C Vulnerability Type: Insufficient Verification of Data Authenticity CWE-345 Keystroke Injection Vulnerability Risk Level: High Solution Status: Open Manufacturer Notification:...

Logitech R700 Laser Presentation Remote Keystroke Injection Vulnerability

Product: R700 Laser Presentation Remote Manufacturer: Logitech Affected Versions: Model R-R0010 PID WD904XM and PID WD802XM Tested Versions: Model R-R0010 PID WD904XM and PID WD802XM Vulnerability Type: Insufficient Verification of Data Authenticity CWE-345 Keystroke Injection Vulnerability Risk...

Google Titan Security Key Recalled After Bluetooth Pairing Bug

Google is recalling Bluetooth versions of its Titan Security Key after finding a vulnerability that allows attackers in close proximity to take control of the device. Google’s Titan Security Key, launched in the U.S. market last August, is a USB dongle that offers an added layer of security...

Sint Wind PI 01.26.19 Authentication Bypass Vulnerability

Exploit for linux platform in category web applications Sint Wind PI v01.26.19 Authentication Bypass Vendor: Tonino Tarsi Product web page: https://github.com/ToninoTarsi/swpi Affected version: 01.26.19 Summary: A Meteo Station software for Raspberry PI. Capability include telephone answering,...

Sint Wind PI 01.26.19 Authentication Bypass

Sint Wind PI v01.26.19 Authentication Bypass Vendor: Tonino Tarsi Product web page: https://github.com/ToninoTarsi/swpi Affected version: 01.26.19 Summary: A Meteo Station software for Raspberry PI. Capability include telephone answering, webcams, digital cameras, web. A Sint Wind is a wind...

Vgate iCar 2 Wi-Fi OBD2 Dongle Authentication Bypass Vulnerability

Vgate iCar 2 Wi-Fi OBD2 Dongle is an automotive fault detection device from VgateTechnology, China. An authentication bypass vulnerability exists in the Vgate iCar 2 Wi-Fi OBD2 Dongle, which stems from the fact that the wireless LAN that the device opens is not protected by an encrypted or...

Vgate iCar 2 Wi-Fi OBD2 Dongle Unencrypted Data Transfer Vulnerability

Vgate iCar 2 Wi-Fi OBD2 Dongle is an automotive fault detection device from VgateTechnology, China. A security vulnerability exists in the Vgate iCar 2 Wi-Fi OBD2 Dongle, which stems from the program's failure to encrypt data packets passed between the iOS or Android app and the OBD dongle, and t...

CVE-2018-11478

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and debug information from the car. This on-board diagnostics feature can also be used to send commands to the car different for every vendor / car product line / car. No...

Design/Logic Flaw

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and debug information from the car. This on-board diagnostics feature can also be used to send commands to the car different for every vendor / car product line / car. No...

Design/Logic Flaw

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the...

Authentication flaw

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured with encryption or a password. This enables anyone within the range of the WLAN to connect to the network without authentication...

CVE-2018-11476

The CVE-2018-11476 entry concerns the Vgate iCar 2 Wi‑Fi OBD2 Dongle, where the device opens an unprotected WLAN that cannot be configured with encryption or a password. This allows anyone within WLAN range to join without authentication, constituting an authentication bypass risk in the affected...

CVE-2018-11476

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured with encryption or a password. This enables anyone within the range of the WLAN to connect to the network without authentication...

CVE-2018-11477

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the...

CVE-2018-11478

The CVE affects the Vgate iCar 2 Wi‑Fi OBD2 Dongle where the OBD port can be accessed over a local Wi‑Fi network without authentication, enabling unauthenticated access to the car data bus (e.g., CAN). The issue arises from missing authentication for OBD communications; impact is exposure of meas...