CVE-2025-6260 Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset us...

CVE-2025-6260

CVE-2025-6260 affects Network Thermostat X-Series WiFi Thermostats: the embedded web server can be reached unauthenticated over LAN or via Internet-exposed router, enabling an attacker to reset user credentials by manipulating the web interface. The exact vulnerable versions are not specified in ...

Network Thermostat X-Series WiFi thermostats: Access control error vulnerability

Network Thermostat X-Series WiFi thermostats is a WiFi only thermostat from Network Thermostat, Inc. An access control error vulnerability exists in Network Thermostat X-Series WiFi thermostats that stems from an embedded web server that allows an unauthorized attacker to reset user credentials b...

CVE-2025-6260: Missing Authentication for Critical Function

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset us...

D-Link DIR-513 Router DoS

The vulnerability of the formLanSetupRouterSettings function in the embedded web server of D-Link’s DIR-513 router software is related to the issue where data is written out of the buffer into memory when processing the curTime parameter. Exploiting this vulnerability could allow a remote attacke...

Embedded Malicious Code

eslint-config-prettier is vulnerable to Embedded Malicious Code. The vulnerability is due to embedded malicious code caused by a compromised install.js script which executes node-gyp.dll malware on Windows during installation...

CVE-2025-54313: Embedded Malicious Code

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows...

wolfSSL (CyaSSL) security vulnerabilities

wolfSSL CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from wolfSSL, Inc. in the United States. A security vulnerability exists in wolfSSL CyaSSL that stems from a certificate validation error that could cause a client to accept a certificate...

wolfSSL security vulnerabilities

wolfSSL CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from wolfSSL, Inc. in the United States. A security vulnerability exists in wolfSSL version 5.8.2 that stems from enabling Curve25519 blinding support by default, which may increase the ris...

eSIM Vulnerability in eUICC Cards Exposes Billions of IoT Devices to Malicious Attacks

Cybersecurity researchers have discovered a new hacking technique that exploits weaknesses in the eSIM technology used in modern smartphones, exposing users to severe risks. The issues impact the Kigen eUICC card. According to the Irish company's website, more than two billion SIMs in IoT devices...

i2c: cros-ec-tunnel: defer probe if parent EC is not present

...

Characterizing Security and Privacy Teaching Standards for Schools in the United States

Increasingly, students begin learning aspects of security and privacy during their primary and secondary education grades K-12 in the United States. Individual U.S. states and some national organizations publish teaching standards -- guidance that outlines expectations for what students should...

CVE-2025-21454 Buffer Over-read in WLAN Embedded SW

Transient DOS while processing received beacon frame...

CVE-2025-21449 Buffer Over-read in WLAN Embedded SW

Transient DOS may occur while processing malformed length field in SSID IEs...

webkitgtk: Logic issue leading to arbitrary code execution

A logic issue was found in WebKitGTK and WPE WebKit in versions prior to 2.32.0. A remote attacker may be able to cause arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Adaptive Variation-Resilient Random Number Generator for Embedded Encryption

With a growing interest in securing user data within the internet-of-things IoT, embedded encryption has become of paramount importance, requiring light-weight high-quality Random Number Generators RNGs. Emerging stochastic device technologies produce random numbers from stochastic physical...

ML-Enhanced AES Anomaly Detection for Real-Time Embedded Security

Advanced Encryption Standard AES is a widely adopted cryptographic algorithm, yet its practical implementations remain susceptible to side-channel and fault injection attacks. In this work, we propose a comprehensive framework that enhances AES-128 encryption security through controlled anomaly...

SUSE CVE-2025-38109

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix ECVF vports unload on shutdown flow Fix shutdown flow UAF when a virtual function is created on the embedded chip ECVF of a BlueField device. In such case the vport acl ingress table is not properly destroyed. ECVF...

AZL-64517 CVE-2025-38109 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix ECVF vports unload on shutdown flow Fix shutdown flow UAF when a virtual function is created on the embedded chip ECVF of a BlueField device. In such case the vport acl ingress table is not properly destroyed. ECVF...

UBUNTU-CVE-2025-38109

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix ECVF vports unload on shutdown flow Fix shutdown flow UAF when a virtual function is created on the embedded chip ECVF of a BlueField device. In such case the vport acl ingress table is not properly destroyed. ECVF...