CVE-2020-35782

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. The TFTP firmware update mechanism does not properly implement firmware validations,...

Design/Logic Flaw

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. The TFTP firmware update mechanism does not properly implement firmware validations,...

CVE-2020-35782

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. The TFTP firmware update mechanism does not properly implement firmware validations,...

CVE-2020-35801

Affected devices: NETGEAR ProSAFE switches JGS516PE, JGS524Ev2, JGS524PE, and GS116Ev2 (pre-2.6.0.48). Description: incorrect configuration of security settings leaves a TFTP server active by default, allowing remote authenticated users to update the switch firmware. Impact: potential unauthorize...

Design/Logic Flaw

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It has a misconfigured FTP service that allows a malicious network user to access system folders and download sensitive files such as the password hash file...

PT-2020-15749 · D Link · D-Link Dsl-2888A

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2888A devices with firmware prior to AU 2.31 V1.1.47ae55 Description: An issue was discovered that allows a malicious network user to access system folders and download sensitive files, such as the password hash file, due to a...

Two Critical Flaws — CVSS Score 10 — Affect Dell Wyse Thin Client Devices

A team of researchers today unveiled two critical security vulnerabilities in Dell Wyse Thin clients that could have potentially allowed attackers to remotely execute malicious code and access arbitrary files on affected devices. The flaws, which were uncovered by healthcare cybersecurity provide...

PT-2020-6288 · NetGear · Netgear Dgn2200V1

Name of the Vulnerable Software and Affected Versions: NETGEAR DGN2200v1 devices version 1.0.0.59 and earlier Description: The issue is related to the mishandling of HTTPd authentication in the NETGEAR DGN2200v1 devices, which can be exploited by a remote attacker to execute arbitrary code. This ...

Design/Logic Flaw

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. The firmware update of affected devices contains the private RSA key that is used as a basis for encryption of communication with the device...

CVE-2020-25233

The vulnerability CVE-2020-25233 affects LOGO! 8 BM (incl. SIPLUS variants) for all versions prior to V8.3. The root cause is that the firmware update package contains the device’s private RSA key used to encrypt communications, enabling potential confidential information disclosure. Impact is dr...

JVN#55917325: Multiple vulnerabilities in Aterm SA3500G

Aterm SA3500G provided by NEC Corporation contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2020-5635 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2| AV:A/AC:L/Au:N/C:P/I:P/A:P| Base Score: 5.8 OS...

PT-2020-13150 · Wago · Wago Plc Family 750-352 +1

Name of the Vulnerable Software and Affected Versions: WAGO PLC family 750-88x versions FW1 through FW10 WAGO PLC family 750-352 versions FW1 through FW10 Description: The issue is related to a denial of service attack. Older firmware versions of the WAGO PLC family are affected. Recommendations:...

Mitsubishi Electric MELSEC iQ-F Series

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: MELSEC iQ-F Series Vulnerability: Improper Check or Handling of Exceptional Conditions 2. RISK EVALUATION Successful exploitation of this vulnerability could cause...

Western Digital My Cloud Multiple Products 5.0 < 5.06.115 Multiple Vulnerabilities

Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

Code injection

Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. This allows attackers to construct firmware that retrieves an unlock code from a secure enclave chip...

CVE-2020-29438

Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. This allows attackers to construct firmware that retrieves an unlock code from a secure enclave chip...

CVE-2020-29438

CVE-2020-29438 affects Tesla Model X key fob firmware prior to 2020-11-23. The vulnerability arises because key fobs accept firmware updates without signature verification, enabling an attacker to craft firmware that retrieves an unlock code from a secure enclave chip. Documents consistently desc...

CVE-2020-29379

An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access...

Authentication flaw

An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access...

CVE-2020-29379

CVE-2020-29379 affects V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. The update process launches a telnetd -l /bin/sh during firmware updates, which can be accessed via TELNET without authentication. This creates unauthenticated access to a shell, enabling potential local/remote m...