Eaton-Intelligent-Power-Manager-Local-File-Inclusion

Eaton-Intelligent-Power-Manager-Local-File-Inclusion Eaton Intelligent Power Manager v1.6 のローカルファイルインクルージョンにより、攻撃者がファイルをインクルードでき、機密情報の漏えい、サービス拒否、コード実行につながる可能性があります。 CVE-2018-12031 脆弱性を悪用するには、'https://HOST/server/nodeupgradesrv.js?action=downloadFirmware&firmware=/../../../../../../../../../../'...

CVE-2026-86474

CVE-2026-86474 affects VEO and VEO-XS Wi-Fi monitors (by Fermax) in versions prior to 01.48.001 . The root cause is the lack of TLS certificate validation when downloading firmware updates, which allows an attacker to perform man-in-the-middle (MITM) attacks on the update channel. The CVSS 4.0 ba...

CVE-2026-86474 Improper Certificate Validation in the Firmware Download vulnerability

The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38590)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the meshSlaveUpdate function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw in the Linux kernel is found in the nfcmrvlnciunregisterdev function in the drivers/nfc/nfcmrvl/main.c file. This flaw can cause both read and write operations to be performed after the device has been freed, without synchronization between the cleanup routine and the firmware download...

CVE-2026-51671

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51671: Improper Access Control

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-68410

A flaw was found in the Linux kernel's Libertas Wi-Fi driver. The helperfirmwarecb function neglects to free a single-stage firmware image after a successful asynchronous load. This leads to a memory leak in the USB firmware-download path. This issue could potentially lead to system instability o...

UBUNTU-CVE-2026-68410

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

CVE-2026-68410 wifi: libertas: fix memory leak in helper_firmware_cb()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

CVE-2026-68410

Technical details about CVE-2026-68410 are not publicly available in the provided documents. Monitor for updates.

PT-2026-69810

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13-rc1 Description A memory leak exists in the USB firmware-download path within the libertas wifi driver. The helper firmware cb function fails to free the single-stage firmware image after a successful...

CVE-2026-68410: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

CVE-2026-44102

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...

CVE-2026-44102 OCPP Firmware download is not properly locked

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...

CVE-2026-44102 OCPP Firmware download is not properly locked

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...

EUVD-2026-51037

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...

CVE-2026-44102

CVE-2026-44102 affects an OCPP backend firmware download workflow. An unauthenticated remote attacker can supply an invalid firmware file to trigger a download, leaving the file accessible for a short period before cleanup deletes it due to improper locking. This can result in brief exposure of t...

CVE-2026-64407

A flaw was found in the Linux kernel's Bluetooth driver. A malicious Bluetooth controller could send a specially crafted firmware download request that causes an out-of-bounds read. This allows the driver to read memory beyond the intended firmware data and send it back over the Universal...

PT-2026-66430

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...