CVE-2025-6260

CVE-2025-6260 affects Network Thermostat X-Series WiFi Thermostats: the embedded web server can be reached unauthenticated over LAN or via Internet-exposed router, enabling an attacker to reset user credentials by manipulating the web interface. The exact vulnerable versions are not specified in ...

CVE-2025-6260 Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset us...

Network Thermostat X-Series WiFi thermostats 访问控制错误漏洞

Network Thermostat X-Series WiFi thermostats is a WiFi only thermostat from Network Thermostat, Inc. An access control error vulnerability exists in Network Thermostat X-Series WiFi thermostats that stems from an embedded web server that allows an unauthorized attacker to reset user credentials b...

The vulnerability of the formLanSetupRouterSettings() function in D-Link DIR-513 router microprogramming software, a built-in web server, allows a hacker to cause a service failure.

The vulnerability of the formLanSetupRouterSettings function in the embedded web server of D-Link’s DIR-513 router software is related to the issue where data is written out of the buffer into memory when processing the curTime parameter. Exploiting this vulnerability could allow a remote attacke...

The vulnerability in the embedded web server microprogramming software of TOTOLINK A3002R, A3002RU, A702R, and EX1200T routers allows a hacker to induce a service failure.

The vulnerability in the embedded web server microprogramming software of TOTOLINK A3002R, A3002RU, A702R, and EX1200T routers is related to the issue of the operation exceeding the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a malicious actor t...

CVE-2019-6326

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have embedded web server attributes which may be potentially vulnerable to Buffer Overflow...

CVE-2019-6325

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery...

CVE-2019-6324

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page...

CVE-2019-19773

Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content=TE935=en=ENUS...

CVE-2019-19772

Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content=TE935=en=ENUS...

CVE-2025-36535

The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational disruption, or arbitrary code execution depending on the environment and exposed functionality...

CVE-2025-36535

CVE-2025-36535 affects AutomationDirect MB-Gateway. The embedded web server lacks authentication/access controls, allowing unrestricted remote access that could enable configuration changes, operational disruption, or arbitrary code execution depending on exposure. Public sources (NVD, CVE listin...

The vulnerability in the embedded web server of the microprogramming software for Rockwell Automation’s Micrologix 1100 and 1400 allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the embedded web server software used in Rockwell Automation’s Micrologix 1100 and 1400 programmable logic controllers is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripti...

The vulnerability in the embedded web server and microprogramming software of TOTOLINK A3002R routers allows a perpetrator to execute arbitrary code.

The vulnerability of the built-in web server microprogramming software on TOTOLINK A3002R routers is related to incorrect code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted POST request /boafrm/formWsc...

[SECURITY] Fedora 39 Update: aws-2020-12.1.fc39

AWS is a complete framework to develop Web based applications. The main part of the framework is the embedded Web server. This small yet powerful Web server can be embedded into your application so your application will be able to talk with a standard Web browser Around this Web server a lot of...

[SECURITY] Fedora 41 Update: aws-24.0.0-3.fc41

AWS is a complete framework to develop Web based applications. The main part of the framework is the embedded Web server. This small yet powerful Web server can be embedded into your application so your application will be able to talk with a standard Web browser...

The vulnerability in the embedded web server software of GoAhead’s Ethernet switch microprogramming systems of the Moxa EDS-405A and Moxa EDS-408A series allows a intruder to cause service interruptions.

The vulnerability in the embedded web server software of GoAhead’s Ethernet switch microprogramming devices of the Moxa EDS-405A and Moxa EDS-408A series is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Micrium uC-HTTP Buffer Error Vulnerability

Micrium uC-HTTP is a software from Micrium USA that provides TCP/IP functionality for devices. The software is designed for embedded applications with a compact, reliable, high-performance TCP/IP stack with dual support for IPv4 and IPv6. A buffer error vulnerability exists in Micrium uC-HTTP...

Lexmark Device Embedded Web Server Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Lexmark Device Embedded Web Server RCE', 'Description' = %q A unauthenticated Remote Code Execution vulnerability exists in the embedded webserve...

CVE-2023-40709

An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b...