PT-2021-16624

Name of the Vulnerable Software and Affected Versions: Tizen versions prior to Firmware update JUL-2021 Release Description: The issue is related to an improper authorization vulnerability in the Tizen factory reset policy. This vulnerability allows untrusted applications to perform a factory res...

Samsung Tizen安全漏洞

Samsung Tizen is an open source Linux kernel-based mobile operating system from South Korea's Samsung, available for devices including smartphones, tablets, smartwatches, netbooks, in-car messaging and entertainment devices, and smart TVs. Tizen suffers from a security vulnerability that stems fr...

CVE-2021-25433: Improper Authorization

Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications to perform factory reset using dbus signal...

CVE-2021-32534

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2021-32534

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

Design/Logic Flaw

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2021-32534

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

PT-2021-19760

Name of the Vulnerable Software and Affected Versions: QSAN SANOS versions prior to 2.1.0 Description: The QSAN SANOS factory reset function does not filter special parameters, allowing remote attackers to inject and execute arbitrary commands without permissions. Recommendations: For versions...

CVE-2021-32534: Improper Neutralization of Special Elements used in an OS Command

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

Zero-Day Used to Wipe My Book Live Devices

Western Digital will start providing free data-recovery services in July for people whose data was wiped off their network-attached storage NAS devices last week, the company said in an update on Tuesday. The company is also planning to offer a trade-in program to get customers onto the cloud –...

Unspecified Vulnerability in Western Digital WD My Book Live

Western Digital WD My Book Live is a network storage device from Western Digital. A security vulnerability exists in Western Digital WD My Book Live 2.x and earlier versions and WD My Book Live Duo, which stems from the fact that the products have an administrator API that can be exploited by an...

Western Digital WD My Book Live 访问控制错误漏洞

Western Digital WD My Book Live is a network storage device from Western Digital. A security vulnerability exists in Western Digital WD My Book Live 2.x and earlier versions and WD My Book Live Duo, which stems from the fact that the products have an administrator API that can be exploited by an...

VulnCheck KEV: CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

MyBook Users Urged to Unplug Devices from Internet

Hard drive giant Western Digital is urging users of its MyBook Live brand of network storage drives to disconnect them from the Internet, warning that malicious hackers are remotely wiping the drives using a critical flaw that can be triggered by anyone who knows the Internet address of an affect...

My Book Live Users Wake Up to Wiped Devices

If you haven’t already, stop reading and go yank your My Book Live storage device offline, lest you join the ranks of those who woke up on Thursday to find that years of data had been wiped clean on devices around the world. Western Digital’s My Book storage device is designed for consumers and...

CVE-2021-21736

A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory...

CVE-2021-21736

A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory...

ZTE ZXHN HS562 访问控制错误漏洞

The ZTE ZXHN HS562 is a smart camera from China's ZTE ZTE. The ZTE ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E suffers from an Access Control Error vulnerability, which stems from a flaw in user rights management, where a user whose shared privileges have been revoked can still control the camer...

CommScope Ruckus IoT Controller 1.7.1.0 Unauthenticated API Endpoints Vulnerability

Three API endpoints for the IoT Controller are accessible without authentication. Two of the endpoints result in information leakage and consumption of computing/storage resources. The third API endpoint that does not require authentication allows for a factory reset of the IoT Controller...

CommScope Ruckus IoT Controller 1.7.1.0 Unauthenticated API Endpoints

KL-001-2021-001: CommScope Ruckus IoT Controller Unauthenticated API Endpoints Title: CommScope Ruckus IoT Controller Unauthenticated API Endpoints Advisory ID: KL-001-2021-001 Publication Date: 2021.05.26 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2021-001.txt 1...